Data Breach Response: Your Forensics Report Can Become Discoverable

Belief: if counsel is involved in a breach response, all the work automatically becomes privileged.

Courts don’t treat it that way. A forensic report can become discoverable when it looks like a business investigation that happened to run through legal.

The operational failure pattern is one blended track. The company hires an incident response vendor it already uses, asks for a single report, and then distributes it broadly to leadership, IT, insurers, auditors, and outside partners. Later, when litigation or regulatory scrutiny hits, the company tries to label the report as privileged. The record shows it was used operationally.

The proof pressure point is structure: who hired the consultant, what the scope was, how the deliverable was framed, and who received it. Broad distribution and mixed purposes undermine protection.

The corrective frame is to separate legal strategy from operational remediation. Keep a clean legal track for counsel’s work and a clean business track for operational response, with disciplined distribution controls. In breach response, sloppiness is not just a technical issue—it becomes a discovery issue.

This post shares general information based on common patterns I see in California workplaces. It is not legal advice, does not create an attorney-client relationship, and outcomes depend on specific facts — no lawyer can guarantee a result. Past results do not guarantee or predict future outcomes. AI may have been used to create this post. All content reviewed by a CA attorney before publication. This post may be attorney advertising.

Michael Trust Law, APC, 703 Pier Avenue, Ste. B367, Hermosa Beach, CA 90254: michaeltrustlaw.com