Summary. Privilege is the only evidentiary protection a company can lose through carelessness on an ordinary Tuesday and never get back. This article explains the two distinct doctrines businesses rely on and constantly conflate: the attorney-client privilege, which protects confidential communications for the purpose of legal advice, and the work product doctrine, which protects materials prepared in anticipation of litigation. It covers who holds the corporate privilege and who may waive it, the control group and subject matter tests resolved by Upjohn v. United States, the special problems of in-house counsel, and the primary purpose tests for dual-purpose communications after In re Kellogg Brown & Root. It works through work product under Rule 26(b)(3), the difference between ordinary and opinion work product, and the substantial need exception. It then addresses waiver in operational terms: Fed. R. Evid. 502, clawback agreements and Rule 502(d) orders, subject matter waiver, at-issue and advice-of-counsel waivers, and disclosure to auditors, insurers, and the government. Sections on the crime-fraud exception, the common interest doctrine, internal investigations, and privilege logs follow, with checklists, a worked example, an FAQ, and related reading.

A general counsel forwards an outside counsel memo to the head of sales, adding "FYI, and let's discuss the pricing rollout." Eleven months later, in an antitrust case, that email is on the screen at a deposition, and so is the memo, and so is every other document about the same subject, because a court found subject matter waiver.

Nobody did anything obviously wrong. The general counsel was doing her job. The head of sales needed to know. The forwarding took four seconds.

That is the shape of most privilege disasters: not dramatic betrayal, but ordinary information flow inside a company whose people do not distinguish between "legal told us" and "our lawyers advised us in confidence."

This article is about building the distinction into how a business actually operates.

The short answer

Attorney-client privilege protects a communication if:

  1. it is a communication,
  2. between privileged persons (client, lawyer, and their agents),
  3. made in confidence,
  4. for the purpose of obtaining or providing legal assistance.

The privilege protects the communication, not the underlying facts. A fact does not become privileged because you told your lawyer about it.

Work product protects "documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative." Fed. R. Civ. P. 26(b)(3)(A). It may be overcome for ordinary work product on a showing of substantial need and inability to obtain the substantial equivalent without undue hardship, but opinion work product (mental impressions, conclusions, opinions, legal theories) receives near-absolute protection. Rule 26(b)(3)(B).

They are different doctrines with different scopes, different holders, and different waiver rules. Work product may protect materials that were never communicated to a lawyer; privilege may protect communications having nothing to do with litigation. Assert both where both apply.

Part I: The corporate attorney-client privilege

Who is the client?

The corporation. Not its officers, not its directors, not its employees individually. The entity holds the privilege, and current management controls it, including the power to waive.

Two consequences companies rarely anticipate:

Upjohn: which employees' communications are privileged?

Before 1981, several courts applied a control group test: only communications with employees in a position to control or take a substantial part in decisions about the legal advice were privileged. Everyone else was fair game.

Upjohn Co. v. United States, 449 U.S. 383 (1981), rejected that test for federal common law. Upjohn's general counsel had sent questionnaires to managers worldwide investigating possible improper payments. The IRS sought the responses. The Sixth Circuit applied the control group test and ordered production.

The Supreme Court reversed, reasoning that "the attorney's advice will also frequently be more significant to noncontrol group members than to those who officially sanction the advice," and that middle-level and lower-level employees are often the ones who possess the facts counsel needs. The Court declined to announce a bright-line replacement test, but the factors it emphasized have become the working standard:

  • The communications were made by employees to counsel at the direction of corporate superiors;
  • for the purpose of securing legal advice for the corporation;
  • concerning matters within the scope of the employees' duties;
  • the employees were aware they were being questioned so the company could obtain legal advice; and
  • the communications were treated as confidential within the company.

Upjohn also confirmed that the privilege protects the communication, not the underlying facts: "The client cannot be compelled to answer the question, 'What did you say or write to the attorney?' but may not refuse to disclose any relevant fact within his knowledge merely because he incorporated a statement of such fact into his communication to his attorney."

Note: Upjohn governs federal common law. Some states, notably Illinois, retain the control group test. In diversity cases, Fed. R. Evid. 501 makes state privilege law applicable to state-law claims, so a multi-state company may face different rules in different courtrooms.

The Upjohn warning

Because the corporation holds the privilege, an employee interviewed in an internal investigation may mistakenly believe counsel represents them. The corrective is an Upjohn warning (sometimes called a corporate Miranda warning), given at the start of every interview:

  • I represent the company, not you personally.
  • This conversation is privileged, but the privilege belongs to the company, which may choose to waive it and disclose what you tell me, including to the government.
  • Please keep this conversation confidential.
  • Do you understand? Do you want to proceed?

Document that the warning was given. If the employee has separate counsel, coordinate. If a conflict emerges (the employee may have personal exposure), stop and consider whether the employee needs independent counsel. See Client Engagement and Conflicts for the broader representation framework.

In-house counsel and the dual-hat problem

In-house lawyers give legal advice and business advice, often in the same email, often to the same audience. Courts scrutinize their communications more closely than outside counsel's for exactly that reason.

The governing question is purpose. A communication is privileged if made for the purpose of obtaining or providing legal advice. Business advice is not privileged, however sophisticated.

Dual-purpose communications have generated a genuine doctrinal split:

  • The "primary purpose" test asks whether the primary purpose was legal advice.
  • The "a primary purpose" or "significant purpose" test, articulated by then-Judge Kavanaugh in In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), asks whether obtaining or providing legal advice was one of the significant purposes. KBR held that an internal investigation conducted under a compliance program, with a business purpose, was privileged where a significant purpose was legal advice.
  • A stricter formulation, applied by some courts including the Ninth Circuit in tax contexts, insists on the single primary purpose.

The Supreme Court granted certiorari to resolve the split in In re Grand Jury, No. 21-1397 (U.S. Jan. 23, 2023) (per curiam), heard argument, and then dismissed the writ as improvidently granted. The split remains.

Practical guidance for in-house teams:

  • Segregate. Legal advice in one document, business recommendations in another, where feasible.
  • Say what you are doing. "You asked for my legal assessment of X" at the top of the memo is not magic, but it is evidence of purpose, and its absence is evidence of the opposite.
  • Do not label everything privileged. Blanket "Attorney-Client Privileged" headers on routine business documents destroy credibility with courts and make the genuinely privileged documents harder to defend.
  • Route requests properly. Legal advice should be requested from counsel, not forwarded to counsel after the fact. A business document does not become privileged by being copied to the general counsel.
  • Watch the forward. Sharing counsel's advice broadly inside the company can undermine confidentiality and, in some circumstances, support a waiver argument. Distribute on a need-to-know basis and say so.

Non-lawyer agents

The privilege extends to communications with agents necessary to facilitate legal advice: interpreters, accountants retained by counsel to help understand financial information (the Kovel doctrine, from United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)), investigators, and consultants.

Two conditions matter: the agent must be retained by counsel (an engagement letter running from the law firm), and the purpose must be to assist counsel in providing legal advice, not to provide independent business or accounting services.

Part II: Work product

Hickman and Rule 26(b)(3)

Hickman v. Taylor, 329 U.S. 495 (1947), created the doctrine to prevent one side from building its case out of the other's preparation. Justice Murphy's formulation is still the best statement of the rationale: allowing such discovery would mean "much of what is now put down in writing would remain unwritten," and "[i]nefficiency, unfairness and sharp practices would inevitably develop."

Rule 26(b)(3) codified it:

  • Ordinary work product (documents and tangible things prepared in anticipation of litigation or for trial) is discoverable only on a showing of substantial need and inability to obtain the substantial equivalent without undue hardship.
  • Opinion work product ("the mental impressions, conclusions, opinions, or legal theories of a party's attorney or other representative") must be protected even when the substantial need showing is made.

"In anticipation of litigation"

The test in most circuits is whether the document was prepared because of the prospect of litigation, considering whether it would have been created in substantially similar form absent that prospect. A minority formulation asks whether litigation was the primary motivating purpose.

Documents created in the ordinary course of business are not work product, even if litigation later happens and even if the documents are useful. Accident reports, quality investigations, and audits prepared routinely are the classic examples of materials that fail the test.

Practical consequence: if you want work product protection for an investigation, structure it that way from the start. Counsel should direct it, the engagement should say it is in anticipation of litigation, and the resulting documents should be identifiable as litigation-related. Doing this after the fact rarely works.

Who is protected

Rule 26(b)(3) covers materials prepared "by or for another party or its representative (including the other party's attorney, consultant, surety, indemnitor, insurer, or agent)." A lawyer is not required. Materials prepared by employees, investigators, or consultants in anticipation of litigation qualify.

Waiver of work product

Work product waiver is narrower than privilege waiver. Disclosure waives protection only where it substantially increases the likelihood that an adversary will obtain the material. Sharing work product with a party having a common interest, or with a consultant under confidentiality, generally does not waive it.

Expert materials

Rule 26(b)(4) provides specific protections for testifying expert drafts and attorney-expert communications, and near-absolute protection for consulting experts. See Expert Witnesses After the 2023 Amendment to Rule 702.

Part III: Waiver

Waiver is where companies actually lose privilege. Learn the categories.

Voluntary disclosure

Disclosing a privileged communication to anyone outside the privileged circle waives the privilege as to that communication.

Subject matter waiver and Rule 502

Historically, courts sometimes found that disclosing one privileged document waived privilege over the entire subject matter. Federal Rule of Evidence 502, enacted in 2008, substantially limited that.

Rule 502(a): when disclosure is made in a federal proceeding or to a federal office or agency and waives privilege or work product, the waiver extends to undisclosed communications only if:

  1. the waiver is intentional;
  2. the disclosed and undisclosed communications concern the same subject matter; and
  3. they "ought in fairness to be considered together."

Rule 502(b): an inadvertent disclosure in a federal proceeding does not operate as a waiver if the holder (1) took reasonable steps to prevent disclosure and (2) promptly took reasonable steps to rectify the error, including following Fed. R. Civ. P. 26(b)(5)(B).

Rule 502(d): the most useful provision in the rule. A federal court may order that disclosure in the litigation before it does not waive privilege, "in which event the disclosure is also not a waiver in any other federal or state proceeding."

Get a Rule 502(d) order in every case with substantial document production. It costs nothing, most courts enter them on a stipulation, and it converts the reasonableness inquiry of 502(b) into a categorical protection. Ask for it at the Rule 26(f) conference. See Rule 26 Initial Disclosures and Discovery Planning.

At-issue and advice-of-counsel waiver

A party waives privilege by putting the substance of the advice at issue. The clearest example is asserting an advice of counsel defense: a defendant who says it relied on counsel's opinion that its conduct was lawful must produce the opinion and related communications, and often the entire subject matter.

This arises constantly in patent willfulness, trademark willfulness, and good-faith defenses generally. The decision to assert reliance on counsel is a strategic one with sweeping discovery consequences, and it should be made deliberately, not reflexively. See The Shield of Good Faith.

Broader "at issue" waiver can also arise where a party's claim or defense depends on its state of mind and the advice bears on it, even without an express reliance defense. Courts differ on how aggressively to apply it.

Disclosure to third parties

  • Auditors. Disclosing legal analyses to outside auditors generally waives privilege, though many courts hold it does not waive work product because auditors are not adversaries. The ABA Statement of Policy on audit response letters exists to manage this, and audit response letters should be drafted to state conclusions without disclosing analysis.
  • Insurers. Communications with an insurer may be protected under the common interest doctrine or as work product, but coverage disputes complicate this. Assume adversity where coverage is contested.
  • The government. There is no selective waiver doctrine in most circuits. Producing privileged material to a regulator in the hope of credit generally waives it as to everyone, including private plaintiffs. This is one of the most consequential decisions in any enforcement matter.
  • Investors and diligence counterparties. Use a common interest agreement and be realistic about whether a genuine common legal interest exists.

Part IV: The crime-fraud exception

Privilege does not protect communications made "in furtherance of" a crime or fraud, whether or not the lawyer knew.

The elements, as most courts state them:

  1. The client was engaged in, or planning, criminal or fraudulent conduct when the communication was made; and
  2. The communication was made in furtherance of that conduct.

Advice about past wrongdoing remains privileged. Advice sought to commit or conceal wrongdoing is not.

United States v. Zolin, 491 U.S. 554 (1989), addressed the procedure. A party seeking to invoke the exception must make a threshold showing, based on non-privileged evidence, of "a factual basis adequate to support a good faith belief by a reasonable person" that in camera review may reveal evidence establishing the exception. If that showing is made, the court may review the documents in camera before deciding.

Note the asymmetry: the exception applies to work product as well, and it survives the client's death, unlike the privilege itself. Swidler & Berlin v. United States, 524 U.S. 399 (1998), held that the attorney-client privilege ordinarily survives death, which is why the crime-fraud route matters.

Part V: The common interest doctrine

The common interest doctrine (often loosely called the joint defense privilege) is not an independent privilege. It is an exception to waiver: sharing privileged material with a party having a common legal interest does not waive the privilege.

Requirements (jurisdictions differ):

  • The information was privileged in the first place.
  • The parties share a common legal interest, not merely a common commercial or business interest.
  • The communication was made in furtherance of that common legal interest.
  • Confidentiality was maintained.

Where courts differ:

  • Some require pending or anticipated litigation; others extend the doctrine to transactional common interests.
  • Some require a written agreement; none require it, but every court finds one helpful.

Practical guidance:

  • Put it in writing before sharing anything. A joint defense or common interest agreement should identify the parties, define the common interest, restrict use and further disclosure, address what happens if the parties become adverse, and state that no attorney-client relationship is created with the other parties' counsel.
  • Beware the exit. Parties in a joint defense group frequently become adverse. The agreement should specify that shared materials remain protected and may not be used against the disclosing party.
  • Do not over-share. The doctrine protects what is genuinely necessary to the common legal interest, not everything.
  • Indemnity relationships (supplier and customer, insurer and insured) are the most common commercial settings, and they are also the settings where the interests most often diverge.

Part VI: Internal investigations

Internal investigations are where every doctrine in this article converges, and they go wrong in predictable ways.

Structure it for privilege from day one:

  • Counsel directs it. An investigation run by HR or internal audit and later handed to legal is not privileged; one directed by counsel from the outset can be.
  • Engagement letter states the purpose: to provide legal advice to the company and in anticipation of possible litigation or government inquiry.
  • Consultants are retained by counsel, not by the business, and their engagement letters say why.
  • Every interview begins with an Upjohn warning, documented.
  • Interview memoranda record counsel's mental impressions, not verbatim transcripts, so they qualify as opinion work product. Verbatim notes are more likely to be treated as ordinary work product and are more vulnerable to a substantial-need showing.
  • The report is addressed to the client (board, audit committee, or general counsel) and states that it was prepared to provide legal advice.
  • Distribution is controlled and logged.

Then decide, deliberately, what to do with it. The most consequential choice is whether to disclose to a regulator or in litigation, because there is no selective waiver in most circuits. Companies frequently want the credit for cooperation and the protection of privilege, and in most jurisdictions they cannot have both. Consider whether an oral download of facts, without producing the report or the underlying interview memoranda, achieves the cooperation objective. Practices vary and the risk is real; get specialist advice.

KBR is the case to know here. It held that a company's internal investigation, conducted pursuant to a compliance program required by regulation and involving non-lawyer investigators, was privileged because a significant purpose was obtaining legal advice. It also held, in a later proceeding, that a company can waive by putting the investigation at issue, for example by using it defensively.

For the technical side of investigations involving data loss, see Trade Secret Cybersecurity Incident Response Checklist and Cybersecurity Incident Response and IP Protection. Note that forensic vendor reports prepared after a breach have been ordered produced in several prominent cases where the vendor relationship predated the incident or served business purposes, which is a strong argument for retaining incident-response vendors through counsel under a litigation-specific engagement.

Part VII: Asserting privilege in discovery

Privilege logs

Rule 26(b)(5)(A) requires a party withholding information to "describe the nature of the documents, communications, or tangible things not produced or disclosed, and do so in a manner that, without revealing information itself privileged or protected, will enable other parties to assess the claim."

Practical guidance:

  • Negotiate the format at the Rule 26(f) conference. Metadata-based logs, categorical logs, and exclusions for post-complaint communications with outside counsel are all commonly agreed and save enormous cost.
  • Include enough to justify the claim: date, author and all recipients (with roles, especially identifying attorneys), document type, and a description that conveys subject matter and purpose without disclosing content.
  • Do not log with boilerplate. "Email reflecting legal advice" for 4,000 entries invites an in camera review and a waiver motion.
  • Log family members carefully. Attachments have their own privilege status; a non-privileged attachment to a privileged email is often producible.

See Preparing a Privilege Log for a detailed walkthrough.

Clawback

Rule 26(b)(5)(B) governs the procedure after inadvertent production: the producing party notifies, and the receiving party must promptly return, sequester, or destroy the material and may not use or disclose it until the claim is resolved. Combine this with a Rule 502(d) order and a clawback provision in the ESI protocol.

Challenging privilege claims

  • Meet and confer with specificity; identify the entries at issue.
  • Attack purpose: business advice masquerading as legal advice.
  • Attack confidentiality: broad distribution lists, forwards to third parties.
  • Attack the anticipation-of-litigation element for work product on documents created in the ordinary course.
  • Consider a crime-fraud showing where the facts support it.
  • Request in camera review of a sample rather than the whole log.

Appealing a privilege ruling

Mohawk Industries, Inc. v. Carpenter, 558 U.S. 100 (2009), held that a disclosure order adverse to the privilege is not immediately appealable under the collateral order doctrine. The available routes are a § 1292(b) certification, a petition for mandamus, or defying the order and appealing a contempt citation. That is a narrow set of options, which is why privilege fights should be won in the district court.

Checklists

Building privilege into the business

  • Written policy on requesting and handling legal advice.
  • Training for managers on what is and is not privileged.
  • Guidance on labeling: use privilege headers accurately and sparingly.
  • Separate legal advice from business recommendations where feasible.
  • Distribution discipline: need-to-know, with a statement of confidentiality.
  • In-house counsel role clarity; document when acting as lawyer.
  • Consultants engaged through counsel when supporting legal analysis.
  • Incident-response vendors retained by counsel under litigation-specific engagements.
  • Common interest agreements in place before sharing with counterparties.
  • Acquisition agreements address who controls pre-closing privilege.

Internal investigation checklist

  • Counsel directs the investigation from the outset.
  • Engagement scope states legal advice and anticipation of litigation.
  • Upjohn warnings given and documented at every interview.
  • Interview memoranda capture counsel's impressions.
  • Document collection and hold coordinated (see Litigation Holds, Spoliation, and Rule 37(e)).
  • Report addressed to the appropriate client representative.
  • Distribution list controlled and logged.
  • Disclosure decisions made deliberately, with waiver consequences assessed.

Litigation checklist

  • Rule 502(d) order entered early.
  • Privilege log format negotiated at Rule 26(f).
  • Screening protocol documented (search terms, reviewer training, QC) to support 502(b) if needed.
  • Advice-of-counsel decisions made with full understanding of waiver scope.
  • Both privilege and work product asserted where both apply.

A worked example

Corvid Health Systems, Inc. (fictional) discovers that a billing module may have generated improper claims. The controller emails the CFO: "I think we have a problem with the modifier logic. Looping in Dana [general counsel]."

Step 1: Is that email privileged? No. It is a business communication that copies a lawyer. Copying counsel does not create privilege.

Step 2: Structure the investigation. Dana engages outside counsel, whose engagement letter states that the firm is retained to provide legal advice regarding potential regulatory exposure and in anticipation of possible government inquiry and litigation. Outside counsel retains a billing-coding consultant. The consultant's engagement letter runs from the law firm, and states that the consultant will assist counsel in rendering legal advice.

Step 3: Interviews. Every interview begins with an Upjohn warning. Two employees appear to have personal exposure; counsel pauses, informs them of their right to separate counsel, and documents it.

Step 4: The memo. Outside counsel's report is addressed to the audit committee, states that it was prepared to provide legal advice and in anticipation of litigation, and is distributed to four named people under a confidentiality legend.

Step 5: Where it can go wrong.

  • If the CFO forwards the report to the company's outside auditors, privilege as to that report is likely waived, though work product may survive because auditors are not adversaries. The safer path is an audit response letter stating conclusions.
  • If the company self-discloses to the regulator and produces the report to obtain cooperation credit, it will likely have waived privilege as to the subject matter, and private plaintiffs will demand the same materials.
  • If the company later defends a False Claims Act case by asserting that it reasonably relied on counsel's advice, it will have waived by putting the advice at issue.
  • If the consultant had been engaged directly by the CFO rather than by counsel, the consultant's analysis would probably not be privileged at all.

Step 6: The remediation problem. Corvid must also fix the billing logic, which requires business people to know what went wrong. The right approach is to convey the facts needed for remediation (the modifier logic is wrong in these three scenarios) without circulating counsel's legal analysis of exposure. Facts were never privileged anyway; the analysis is what needs protecting.

That last distinction, facts versus analysis, is the one that solves most practical privilege problems inside a company.

Frequently asked questions

Is everything I tell my lawyer privileged? Communications made in confidence for the purpose of obtaining legal advice are. Underlying facts are not, and you can be required to testify to facts even if you also told them to your lawyer.

Does copying the general counsel make an email privileged? No. Purpose controls, not the distribution list. Copying counsel on a business email creates no privilege and, done routinely, undermines the credibility of your genuine privilege claims.

Are communications with in-house counsel privileged? Yes, when made for the purpose of legal advice. Because in-house lawyers also give business advice, courts scrutinize purpose more closely, and dual-purpose communications face the primary purpose or significant purpose tests, which differ by circuit.

What is an Upjohn warning and do we have to give one? It is a notice to an employee that counsel represents the company, not them, and that the company controls the privilege. There is no rule requiring it in every case, but ethical obligations and practical necessity make it standard, and failing to give one can create serious problems if the employee later claims they believed counsel represented them.

We produced a privileged document by mistake. Is it gone? Not necessarily. Fed. R. Evid. 502(b) protects inadvertent disclosure where reasonable steps were taken to prevent and to rectify. A Rule 502(d) order eliminates the argument entirely, which is why you should get one in every document-intensive case.

Can we share privileged material with a co-defendant? Under a common interest agreement, generally yes, without waiver, if a genuine common legal interest exists. Put it in writing before you share, and address what happens if you become adverse.

Does privilege protect our forensic report after a data breach? Sometimes, and less often than companies assume. Reports from vendors with pre-existing business relationships, or that serve remediation as well as legal purposes, have been ordered produced in several cases. Retain incident-response vendors through counsel, under an engagement that states the litigation purpose, and keep remediation workstreams separate.

If we tell the government, do we lose privilege as to everyone? In most circuits, yes. There is no selective waiver doctrine. This is one of the most consequential decisions in an enforcement matter and should never be made casually.

Who owns the privilege after we sell the company? Generally the buyer, unless the transaction documents allocate it otherwise. Negotiate this expressly; sellers routinely want to retain privilege over pre-closing deal communications, and that has to be written down.

Can I appeal if the judge orders me to produce privileged documents? Not immediately as of right. Mohawk Industries forecloses collateral order appeal. Your options are § 1292(b) certification, mandamus, or contempt. Win it below.

Closing thought

Privilege rewards habits, not heroics. The companies that keep it are not the ones with the best briefs; they are the ones where legal advice is requested from lawyers rather than forwarded to them, where the privilege label means something because it is used sparingly, where consultants who support legal analysis are engaged by counsel, and where somebody thought about the audit letter before the auditor asked.

The companies that lose it are usually well-run in every other respect. They lose it because privilege is counterintuitive: it protects a communication, not a fact; it belongs to the entity, not the person speaking; it can be destroyed by a helpful forward; and it cannot be restored.

Two habits prevent most of the damage. First, distinguish facts from analysis, and circulate the facts freely while protecting the analysis. Second, get a Rule 502(d) order in every case. The first is culture and takes years. The second takes ten minutes and is the best return on effort in all of discovery practice.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. Privilege law varies by jurisdiction, and state privilege law may govern state-law claims. Consult qualified counsel about any particular communication, investigation, or disclosure decision.