Whom do you call first when you discover that your system has been breached? Luckily for lawyers, the right answer clearly seems to be “call your lawyer first.” This means before you call an outside company to remediate, or your public relations firm to guide you in appropriate disclosure. This is particularly true with respect to companies with in-house counsel.

Generally, communications between a company and its counsel are privileged and not discoverable. Sometimes, in house counsel, by acting normally, may waive that privilege where inside counsel is functioning more as a business executive than an attorney. If you first contact outside counsel, and have outside counsel supervise the audit of the breach (hiring third-party experts), and if your communications relative to fault are between the company and outside counsel, then the privilege which protects communications with your lawyer will be preserved; only facts you want disclosed will become public.