Under the Digital Personal Data Protection Act, 2023
Attorney-Client Privilege as the Decisive Legal Advantage
With Comparative Reference to GDPR Enforcement Practice in Europe
Created By Shubhank Suman- AI, Privacy, and IP Counsel
A data breach is an evidentiary event, not just a technical incident. This report shows why external counsel-led privilege (Attorney- Client Privilege) is the decisive advantage, structuring investigations, forensics, and regulatory communications to reduce exposure while enabling accurate compliance.
What this report covers- DPDPA breach obligations and enforcement stakes:
- What must happen after a breach, and why the regulator’s inquiry powers make documentation and timelines decisive.
- Role clarity in crisis: A phase-by-phase breach response model mapping the DPO, CISO, in-house legal, and external counsel, highlighting where discovery risk arises.
- Privilege under Indian law: How attorney-client privilege works, why in-house privilege is contestable, and how “dominant purpose” arguments are used to defeat protection claims.
- Forensic privilege architecture: How to structure counsel-led commissioning of forensic investigations so the most damaging technical findings are protected without compromising remediation.
Attorney-Client Privilege as the Decisive Legal Advantage | Page 1
Introduction
When a personal data breach occurs, an organization’s instinct is to rely on its Data Protection Officer, Chief Information Security Officer, and in-house legal team. These are competent professionals who perform essential operational functions. This report does not challenge their importance. It identifies a legal gap that none of them can fill, regardless of their qualifications or seniority.
That gap is attorney-client privilege. Under Section 126 of the Indian Evidence Act, 1872, privilege attaches only to communications with an enrolled, practicing advocate. An in-house lawyer's enrolment is suspended the moment they accept salaried employment, by operation of Rule 49 of the Bar Council of India Rules. A DPO, usually legally trained, holds no enrolment. A CISO is not a legal professional. A consulting firm has no privilege protection of any kind.
The practical consequence is that every document created by these internal actors in the course of a breach investigation, including forensic reports, root cause analyses, internal legal memos, and DPO logs, is potentially discoverable by the Data Protection Board of India in proceedings under Section 28 of the DPDPA, or by claimants in civil litigation. External counsel is the only actor who can guarantee that the most sensitive findings of a breach investigation remain protected from disclosure.
This report demonstrates this proposition through analysis of Indian law, and through reference to enforcement outcomes in Europe under the General Data Protection Regulation, where the benefit of external counsel privilege has been demonstrated in real enforcement proceedings with measurable financial consequences.
Actor | Privilege Status | Can They Protect Breach Investigation Findings? |
|---|---|---|
External Counsel | Full Section 126 protection as enrolled advocate | Yes. |
In-House Counsel | Enrolment suspended under BCI Rule 49. Privilege fragile and contestable. | No. Regulators routinely defeat in-house privilege claims. |
DPO | No legal enrolment. No privilege of any kind. | No. All DPO records are discoverable. |
CISO | Not a legal professional. No privilege. | No. All CISO records and forensic instructions are discoverable. |
Consulting Firm | No legal status. Zero privilege. | No. Every report is fully available to the DPBI and civil litigants. |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 2
Part I: The DPDPA Framework And The Stakes Of A Data Breach
1.1 What The DPDPA Requires When A Breach Occurs
The Digital Personal Data Protection Act, 2023 imposes a clear set of obligations on Data Fiduciaries when a personal data breach occurs. Section 8(6) requires notification to the Data Protection Board of India and to affected Data Principals as soon as reasonably practicable. The notification must describe the nature of the breach, the categories of data affected, the number of individuals affected, and the measures taken or proposed.
Beyond notification, the Data Protection Board has extensive inquiry powers under Section 28. It can summon documents, examine persons on oath, require production of records, and impose penalties under Section 33 of up to INR 250 crore per instance for failure to implement adequate security safeguards. These are the powers of a regulatory prosecutor, not an administrative reviewer.
1.2 The Breach Response Architecture: Who Does What
In practice, four types of actors respond to a breach. The CISO leads technical containment and forensic investigation. The DPO manages regulatory notification and data principal communication. The in-house legal team handles contracts, insurance, and internal governance. External counsel manages legal privilege, regulatory strategy, and formal proceedings. Each role is necessary. But only one creates legal protection for the investigation itself.
Response phase | Internal actors (what they do) | Typical internal outputs (high discovery risk) | Practical example (what can go wrong) | What external counsel adds (unique value) | Practical example of counsel-led approach (what changes) |
|---|---|---|---|---|---|
1) Breach detection & triage (first 0–4 hours) | CISO confirms incident, initiates containment. DPO is alerted; begins assessing notifications. | “Initial breach summary” email; Teams chat transcripts; early severity rating; “we’re exposed” internal note; incident ticket with root-cause guesses. (These early documents become the regulator’s most reliable evidence of what you knew and when.) | Example: SOC analyst emails: “Looks like all encryption keys possibly leaked.” Later forensic work shows only a subset was accessed. But the early email is now a self-incriminating exhibit in a DPBI inquiry. | Privilege “from minute 1.” External counsel engagement ensures the first written legal characterization is created within privilege, and prevents the organization from generating discoverable “first impressions” that later get used against it. | Counsel-led: CISO/DPO do verbal briefings; counsel issues a short “privileged incident intake” memo capturing facts & legal issues. That memo, not scattered emails becomes the authoritative narrative. (Operational work continues, but written legal |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 3
framing begins under privilege.) | |||||
2) Forensic investigation (hours 4–72) | CISO engages/coordinates forensic firm; IT preserves logs; security team shares images, IOCs, timelines. | Forensic engagement SOW; emails instructing forensics; draft forensic reports; root cause analysis; vuln backlog; “known issue” references. (If internally commissioned, these materials are typically discoverable.) | Example: The forensics report states: “MFA disabled on admin console for 6 months” and “critical patch overdue.” In a DPBI inquiry, this single report can become the backbone for alleging inadequate safeguards. | Forensic privilege umbrella. External counsel commissions the forensic firm as legal agent under a legal instruction letter identifying legal advice/anticipated proceedings as the dominant purpose, aimed at preventing compelled production later. | Counsel-led: Forensics are retained by counsel (not the CISO), work product is marked for legal advice, and findings are delivered to counsel for legal analysis. The company still learns the facts, but the most damaging technical conclusions are structured as privileged work product where defensible. |
3) Legal qualification of the incident (threshold + exposure) | DPO assesses whether it is a “personal data breach” meeting notification criteria; in-house legal reviews exposure. | DPO decision logs; internal legal memo; risk register entry; board update drafts; “severity classification” worksheet. (These are vulnerable because internal actors don’t create Section 126 privilege reliably.) | Example: DPO writes: “We think notification not needed; likely no personal data impacted.” Later it emerges personal data was accessed. That earlier log can be used to argue delay/understatement, similar to the “internal assessment becomes evidence” dynamic described in your report. | Privileged legal advice memo. External counsel produces the formal legal analysis (notification obligation, risk, defenses), designed to remain protected under Section 126 where conditions are met. | Counsel-led: DPO provides facts; counsel issues a “privileged legal qualification” memo: Is it a breach? Is notification triggered? What to say now vs later? DPO’s operational log records only actions taken (timestamps), while legal reasoning stays in counsel’s memo. |
4) Breach notification to | DPO drafts and files notification; | Notification draft versions; internal | Example: In the rush, the draft says: “We | Calibrates admissions to | Counsel-led: Notification |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 4
DPBI + affected individuals | comms team prepares templates; in-house legal may review. | emails debating wording; “admissions” in templates; inconsistent numbers/timelines across drafts. (Final notification is public by nature; drafts/side emails can be damaging if produced.) | failed to implement adequate safeguards.” That line is not legally required and can be treated as an admission if later produced during inquiry/civil claims. | legal minimum while remaining accurate. External counsel ensures notification contains what the statute requires (nature, categories, affected persons, measures) without avoidable speculation or over-disclosure. | uses disciplined phrasing: confirmed facts + known scope + steps taken, with clear “ongoing investigation” language. Counsel keeps drafts and legal rationale within privileged files; the submitted notice stays factual, consistent, and non-speculative. |
|---|---|---|---|---|---|
5) Regulatory inquiry defense (Section 28 DPBI inquiry) | DPO + in-house counsel respond to notices, collect documents, coordinate interviews, and provide explanations. | Document production bundles; interview prep notes; chronologies; “lessons learned” reports; remediation plans. (Anything not privileged may need to be produced if demanded.) | Example: DPBI asks for “all forensic reports and internal assessments.” If the forensics were internally commissioned, the organisation may be forced to produce the most damaging documents, handing the regulator a ready-made prosecution file. | Privilege assertions + scope control. External counsel manages what can be withheld legitimately, structures submissions, and prevents inadvertent waiver through sloppy sharing. (Only privileged documents can be withheld on that basis.) | Counsel-led: Counsel creates a production protocol: what is responsive, what is privileged, what can be summarized instead of produced, how to handle interviews, and how to present remediation cooperatively without turning internal candid analysis into evidence. |
Part Ii: Attorney-Client Privilege And Why In-House Counsel Cannot Guarantee It
2.1 The Statutory Basis: Section 126 Of The Indian Evidence Act, 1872
Section 126 of the Indian Evidence Act, 1872 provides that no barrister, attorney, pleader, or vakil shall be permitted to disclose any communication made to them in the course of their professional employment as such, or any document they became acquainted with through that employment. The privilege belongs to the client and is absolute
Attorney-Client Privilege as the Decisive Legal Advantage | Page 5 once the three conditions are met: the person receiving the communication is a practicing advocate, the communication was made in their professional capacity; and the purpose was obtaining legal advice.
External counsel satisfies all three conditions completely. The moment an organisation retains an external law firm and communicates about a breach, every such communication, every piece of advice, and every document prepared by that counsel for the purposes of that engagement is absolutely protected.
2.2 Why In-House Counsel Is Different In Law
The Bar Council of India Rules, Part VI, Chapter II, Rule 49, state plainly that an advocate shall not be a full-time salaried employee of any person, firm, corporation, or government. An advocate who accepts salaried employment is required to give up practice. The legal consequence is that their enrolment as a practicing advocate becomes dormant. They are legally an employee with a legal background, not a practicing advocate.
Because Section 126 applies only to barristers, attorneys, pleaders, and vakils who are actively practicing, an in-house lawyer whose enrolment is dormant does not qualify. Regulators and adversarial parties routinely exploit this gap by arguing that in-house legal communications are corporate documents, not privileged legal advice.
The Supreme Court's in Deepak Aggarwal v. Keshav Kaushik (2013) 5 SCC 277 evaluated whether full-time salaried government law officers (such as Public Prosecutors) ceased to be advocates. The Court applied a "functional test," ruling that if a salaried employee's terms of engagement require them to act or plead in courts on behalf of their employer, they do not cease to be an advocate under Rule 49. This exception, however, is narrow and applies only to salaried roles that involve actual representation in court; lawyers employed purely for advisory or compliance functions do not fall within it.
2.3 The Dominant Purpose Test: The Regulator's Primary Tool
Even where courts have extended some conditional protection to in-house legal advice, they apply the Dominant Purpose Test, which asks: what was the primary reason this document was created? If the dominant purpose was legal advice in anticipation of litigation or regulatory proceedings, some protection may exist. If the dominant purpose was corporate risk management, business operations, or regulatory compliance, the document is not protected.
In a breach context, the dominant purpose test is particularly dangerous for organizations that rely on internal teams. A root cause analysis prepared by the CISO is an IT operations document. A DPO's severity assessment is a compliance document. An in-house legal memo summarizing these findings is prepared by a corporate employee for the dominant purpose of managing the company's regulatory and commercial exposure. Courts and regulators consistently characterize such documents as business documents, not privileged legal advice.
The English Court of Appeal articulated this principle clearly in Three Rivers District Council v. Bank of England (No. 5) [2003] EWCA Civ 474, holding that legal advice privilege applies only to communications with a lawyer acting in a genuine legal capacity, where the dominant purpose is legal rather than commercial. Indian courts have adopted this approach.
Attorney-Client Privilege as the Decisive Legal Advantage | Page 6
Illustrative Scenario: When an In‑House Privilege Claim Fails in a Regulatory Investigation | |
|---|---|
Facts | A large Indian organization becomes the subject of a formal regulatory investigation following allegations of misconduct and control failures. During the early stage of the investigation, the organization asks its in-house legal team to conduct an internal inquiry and prepare internal investigation reports summarizing findings, witness interviews, and recommended remediation steps. When the regulator later issues a document production demand, it specifically requests:
The organization refuses to produce some of these documents, asserting that: The investigation outputs are legal advice They were prepared by lawyers They should therefore be treated as privileged and protected from disclosure |
Relevance | What the Regulator Argues (Illustrative) The regulator disputes the privilege claim and contends that: In-house counsel are employees, and their communications may be treated as corporate records, not protected legal communications. The reports were created mainly for risk management, governance, and regulatory compliance, rather than for litigation defense or independent external legal advice. |
Part Iii: The Forensic Privilege Umbrella: Why The Commissioning Party Decides Everything
3.1 The Forensic Investigation Problem
Every serious data breach requires a technical forensic investigation. Specialist firms Forensics teams are engaged to determine the root cause, scope of data exfiltration, attack timeline, and security failures. The resulting forensic report, in the absence of legal privilege, is the single most damaging document a Data Fiduciary can produce. It identifies security failures, establishes the organization’s prior knowledge of vulnerabilities, quantifies the data exposed, and provides a complete evidentiary foundation for a maximum penalty claim.
3.2 The Agency Doctrine: How External Counsel Shields The Forensic Report
The legal mechanism for protecting forensic reports is the extension of attorney-client privilege to third parties engaged as agents of counsel. When a lawyer retains a third-party expert for the dominant purpose of providing
Attorney-Client Privilege as the Decisive Legal Advantage | Page 7 legal advice to the client in connection with anticipated litigation or regulatory proceedings, that expert becomes an agent of the lawyer. The expert's work product falls within the lawyer's professional privilege.
This doctrine was established in Upjohn Co. v. United States, 449 U.S. 383 (1981), where the US Supreme Court held that attorney-client privilege protects communications between attorneys and their agents made for the purpose of providing legal advice. The English Court of Appeal affirmed the equivalent principle in Three Rivers (No. 5). Indian courts have recognized this approach, grounded in the purposive interpretation of Section 126 of the Indian Evidence Act.
The critical practical requirement is that the engagement of the forensic firm must be made by an enrolled external advocate, acting in their legal capacity, under an instruction letter that specifies legal advice in anticipation of DPBI proceedings as the dominant purpose. Everything else flows from this single decision.
Who Instructs the Forensic Firm | Is the Forensic Report Protected? | Practical Consequence |
|---|---|---|
CISO or IT security team | No. Zero privilege of any kind. | The report is fully discoverable by the DPBI, civil plaintiffs, and any regulatory body. It establishes negligence, causation, and scope in one document. |
In-house counsel | Unlikely. The dominant purpose will be contested. The umbrella will probably collapse on regulatory challenge. | Regulator argues that in-house counsel, as an employee, was managing business risk. If accepted, every forensic document is disclosed. SFO v. ENRC [2017] demonstrates this collapse. |
External counsel (under legal instruction letter) | Yes. Full privilege umbrella over all forensic documents, emails, and findings. | The DPBI cannot compel production under Section 28. Civil claimants cannot discover the report. The Data Fiduciary's most sensitive findings remain protected. |
3.3 Sfo V. Enrc: When In-House Instruction Collapses The Umbrella
In Serious Fraud Office v. ENRC [2017] EWHC 1017 (QB), the English High Court considered whether an internal investigation supervised by in-house counsel attracted privilege. The court found that the dominant purpose of the investigation was to satisfy the regulator and manage business risk, not to obtain independent legal advice in anticipation of litigation. It pierced the privilege claim entirely. Every document produced by third-party consultants instructed by in-house counsel became available to the SFO.
This decision is directly applicable to DPDPA breach response. If the DPBI challenges a privilege claim over a forensic report instructed by in-house counsel, it will rely on this reasoning. The argument is simple: in-house counsel are employees whose dominant purpose is corporate risk management, not independent legal advice. If the tribunal accepts this, every forensic finding, every root cause analysis, and every consultant email becomes evidence that the DPBI can use freely.
Attorney-Client Privilege as the Decisive Legal Advantage | Page 8
Case Study 3: Target Corporation Data Breach, USA (2013-2014): The Correct Forensic Privilege Architecture | |
|---|---|
Facts | Following Target's breach affecting 40 million payment cards, external counsel retained forensic firm Stroz Friedberg under a legal instruction letter specifying litigation preparation as the dominant purpose. Plaintiffs sought production of the Stroz Friedberg report in class action proceedings. |
Relevance | The US District Court for the District of Minnesota upheld Target's privilege claim. The forensic report was protected because it had been commissioned by external counsel acting as legal agents, for the dominant purpose of legal representation. Had Target's internal security team commissioned the investigation, the report would have been produced. The identity of the instructing party and the stated purpose of the engagement were legally decisive. This is the structure every Indian Data Fiduciary should replicate under DPDPA. |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 9
Part Iv: The Privilege Architecture Across The Breach Response Lifecycle
4.1 The First Hours: Why The Opening Documents Define The Case
The documents created in the first two to four hours after a breach is confirmed are the most important documents in the entire regulatory lifecycle. They record the organization’s unfiltered understanding of the breach at its most serious moment. Regulators treat early internal assessments as the most reliable evidence of what the organization knew, when it knew it, and how it privately assessed its own culpability.
If those early documents are created by the CISO's team, the DPO, or in-house counsel, they are corporate records with no privilege protection. If they are created under the supervision of external counsel, they are privileged legal advice documents that the DPBI cannot compel. The choice of who creates the opening documents of a breach response is, in legal terms, the choice of whether the company's most candid self-assessment becomes the prosecution's evidence.
4.2 Privilege And The Breach Notification
The breach notification filed with the DPBI under Section 8(6) is a public document, by its nature. External counsel's role in the notification is not to make it privileged; it is to ensure that the notification says precisely what the law requires, framed in a manner that does not inadvertently expand the company's regulatory exposure beyond what the facts demand.
In-house teams in crisis situations consistently over-disclose: they provide preliminary findings, speculative scope assessments, and candid admissions of security failure that are not required by the statute. External counsel, applying legal professional judgment, calibrates the notification to the legal minimum while remaining accurate and honest. The legal advice that informs this calibration, and the drafts created in the process, are privileged.
4.3 The Dpbi Inquiry: Privilege In Adversarial Proceedings
When the DPBI initiates an inquiry under Section 28, the organisation faces a quasi-judicial process with real adversarial characteristics. The Board can require production of any document it considers relevant to the inquiry. The Data Fiduciary's ability to resist such production requests rests entirely on privilege. If the investigation was managed externally, the most sensitive findings are protected. If it was managed internally, they are not.
Both DPOs and in-house counsel may participate in DPBI proceedings and may present the company's position. That is not the issue this report addresses. The issue is that when the DPBI issues a document production notice, the only documents that can be legitimately withheld from production are those that qualify for privilege under Section 126. That means documents created by, or at the direction of, external counsel. Every other document must be produced.
Case Study 4: Anthem Inc. Data Breach, USA (2015): Forensic Report Shielded in Class Action Litigation | |
|---|---|
Facts | Anthem retained external counsel (Calfee Halter and Griswold) who commissioned Mandiant to conduct the breach investigation under a legal instruction letter identifying anticipated litigation as the dominant |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 10
Case Study 4: Anthem Inc. Data Breach, USA (2015): Forensic Report Shielded in Class Action Litigation | |
|---|---|
purpose. Plaintiffs sought production of the Mandiant report in consolidated class action proceedings. | |
Relevance | The court upheld the privilege claim in full. Every technical finding, every security failure identified, every assessment of the breach's scope was protected from civil discovery. Anthem retained full knowledge of its own security position without that knowledge becoming evidence against it. For Indian Data Fiduciaries, this means that the DPBI, exercising Section 28 powers, cannot compel production of a forensic report commissioned in this manner. The Data Fiduciary knows its exposure; the regulator does not have it on the record. |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 11
Part V: Lessons From GDPR Enforcement In Europe
5.1 Why European Practice Is Directly Relevant To India
The GDPR has been in force since May 2018 and has generated the world's most extensive body of data privacy enforcement practice. By 2025, total fines issued under the GDPR exceeded EUR 4.5 billion. The enforcement architecture of the GDPR, with its independent supervisory authorities, mandatory breach notification, and substantial penalties, is structurally analogous to what the DPDPA creates. The lessons of seven years of European enforcement are directly applicable to Indian Data Fiduciaries building their DPDPA response infrastructure.
The most consistent finding from European enforcement is measurable: organizations that engage external counsel immediately after breach discovery, embed counsel in the forensic instruction process, and manage regulatory correspondence through a legally privileged framework consistently achieve better regulatory outcomes than those that rely on internal teams. This is not a qualitative assessment. It is demonstrated by documented penalty reductions in actual enforcement decisions.
5.2 The European Standard Practice: The 72-Hour External Counsel Protocol
Under GDPR Article 33, breach notification to the supervisory authority must be made within 72 hours. Major European organizations have developed a breach response protocol calibrated to this window that prioritizes privilege creation from the outset. Within the first hour of confirmed breach discovery, external counsel is notified. Within four hours, external counsel issues a legal instruction letter to a pre-retained forensic firm. Within 24 hours, a privileged legal qualification memo is produced assessing the notification obligation. Within 48 hours, the notification strategy is agreed. By the 72-hour mark, a legally reviewed notification is filed.
Every step in this protocol is calibrated to ensure that the most sensitive findings of the breach investigation are created within a privilege framework. The DPO files the notification; external counsel has shaped its content. The forensic firm investigates; external counsel has commissioned them as legal agents. The internal team responds to the regulator; external counsel has approved the scope of disclosure.
Case Study 5: Marriott International, ICO (GDPR) Enforcement, 2020: An 80% Penalty Reduction Attributed to Response Management | |
|---|---|
Facts | Marriott suffered a breach affecting 339 million guest records stemming from the 2016 Starwood acquisition. The ICO proposed a penalty of GBP 99 million. Marriott's external counsel managed the post-discovery investigation, instructed forensic experts as legal agents, managed all regulatory submissions, and represented Marriott in the ICO inquiry. The ICO's final decision reduced the penalty to GBP 18.4 million. |
Relevance | The ICO's decision expressly distinguished between Marriott's pre-discovery security failures (penalised) and its post-discovery response (acknowledged as professional, cooperative, and systematic). The penalty reduction of over 80% was directly attributable to the structured, legally managed breach response. No |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 12
Case Study 5: Marriott International, ICO (GDPR) Enforcement, 2020: An 80% Penalty Reduction Attributed to Response Management | |
|---|---|
privileged investigation findings appeared in the ICO's decision as evidence against Marriott. For Indian Data Fiduciaries, this case demonstrates that external counsel engagement is not merely about protecting documents. It shapes the regulatory narrative, influences the penalty outcome, and creates a record of responsible response that regulators formally credit. |
Case Study 6: Twitter (X), DPC Ireland (GDPR) Enforcement, 2022: Internal Assessment Becomes Prosecution Evidence | |
|---|---|
Facts | Twitter was fined EUR 450,000 for late notification of a 2018 breach. Twitter's initial breach assessment was conducted internally. DPO logs, internal legal memos, and in-house counsel's analysis of breach severity were all examined by the DPC in its inquiry. The DPC found that certain internal assessments had understated the breach's severity, contributing to the delayed notification. These documents were available to the DPC precisely because they had been prepared by internal teams with no privilege protection. |
Relevance | Had Twitter's legal qualification of breach severity been conducted by external counsel and recorded in a privileged advice memo, the DPC would not have had access to Twitter's internal deliberative process. The notification might still have been late, but the DPC's ability to demonstrate that Twitter's internal assessment was knowingly understated would have been severely limited. The privilege gap in internal documentation directly contributed to the regulatory finding. This is the risk that every Data Fiduciary managing DPDPA compliance through internal teams must understand. |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 13
Part Vi: The Consulting Organisation Problem And The Zero-Privilege Reality
Technology consulting organisations, including the Big Four professional services firms and specialist data protection consultancies, occupy an important operational role in DPDPA compliance. Their readiness assessments, data mapping exercises, and breach response planning services are genuinely valuable. This report does not dispute that.
What this Part establishes, without qualification, is that consulting firms are legally inert in every dimension that matters when enforcement begins. A compliance gap assessment prepared by a consulting firm that identifies security vulnerabilities not remediated before the breach is, from the DPBI's perspective, the clearest evidence available of the organisation's prior knowledge of its own vulnerability. There is no legal mechanism by which this document can be shielded from a Section 28 production notice. A consulting firm's engagement creates no privilege. Its reports are fully discoverable. They become the DPBI's preferred evidence.
The only way to obtain a technically equivalent assessment with privilege protection is to have external counsel instruct a specialist technical expert as a legal agent, for the purpose of advising counsel on the client's legal position. The technical content of the resulting report is identical to what the consulting firm would have produced. Its legal character is completely different: it is a privileged legal document, not a discoverable advisory report.
6.2 Summary: What Each Actor Can And Cannot Protect
Legal Function | External Counsel | In-House Counsel | DPO | Consulting Firm |
|---|---|---|---|---|
Section 126 privilege (absolute) | YES | Fragile / contestable | NO | NO |
Forensic privilege umbrella | YES (robust) | Likely to collapse (SFO v. ENRC) | NO | NO |
Privileged advice on notification threshold | YES | No (dominant purpose: compliance) | NO | NO |
Resist DPBI document production (Section 28) | YES | Unlikely | NO | NO |
Influence penalty through managed regulatory narrative | YES (Marriott: 80% reduction) | Limited | Liaison only | Advisory only |
Create documented record of cooperative response | YES (legally structured) | Yes (employee document) | Yes (compliance log) | Yes (advisory report, discoverable) |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 14
Part Vii: Practical Implementation: Embedding External Counsel Before The Crisis
7.1 The Pre-Breach Investment
The most consistent lesson from GDPR enforcement in Europe is that external counsel's effectiveness in a breach scenario depends almost entirely on how prepared they are before the breach occurs. A law firm engaged cold in the first hour of a crisis, briefed on the fly by a panicking technical team, is a fundamentally different resource from a law firm that has reviewed the organization’s data processing architecture, drafted the form of forensic instruction letter, participated in tabletop breach simulations, and been named in the breach response plan as the immediate-notification contact.
European organizations operating under GDPR maintain standing retainer arrangements with data protection law firms. These retainers include pre-agreed breach response protocols, pre-drafted forensic instruction letters ready to execute within minutes of breach confirmation, agreed privilege protocols that the internal team has rehearsed, and annual simulation exercises in which external counsel participates as a full member of the response team.
Indian Data Fiduciaries building DPDPA compliance infrastructure in 2025 should adopt this model without qualification. The cost of a standing retainer is negligible relative to the INR 250 crore per-instance penalty exposure under Section 33. The cost of failing to have such an arrangement, measured by the evidentiary damage caused in the first hours of an unmanaged breach response, can and frequently does exceed that cost many times over.
7.2 The Privilege Discipline: Document Creation Protocols
The most important single practice discipline a Data Fiduciary can adopt is this: before external counsel is engaged, no internal written assessment of breach severity, security failure, or regulatory exposure should be created. Verbal briefings between the CISO and DPO are appropriate. Email chains documenting the evolving internal understanding of a breach's severity, created before counsel's engagement, are permanently and irrevocably discoverable. They become the opening evidence in any regulatory proceeding.
The internal team should be trained to understand that the first written record of breach severity, the first written assessment of notification obligation, and the first written analysis of regulatory exposure should all be created by, or at the direction of, external counsel, within a privilege framework. This is not dishonest or evasive; it is the application of legal professional judgment to a crisis situation, which is precisely what legal privilege was designed to enable.
7.3 The Role Of Each Internal Actor Within The Privileged Framework
External counsel's central role in breach response does not diminish or replace the functions of internal actors. It coordinates and protects them. The CISO continues to lead technical containment. The DPO continues to manage regulatory liaison and data principal notification. The in-house counsel continues to manage contracts, insurance, and board communications. What changes is that the most legally sensitive outputs of these activities, the findings that could become evidence of negligence, are created under a privilege framework rather than as discoverable corporate documents.
Attorney-Client Privilege as the Decisive Legal Advantage | Page 15
Actor | Function That Remains With Them | Function That External Counsel Must Own |
|---|---|---|
CISO | Technical containment, system restoration, security remediation, technical briefing of forensic firm | Commissioning the forensic firm under a legal instruction letter. The forensic report must be instructed by external counsel to attract privilege. |
DPO | Filing the breach notification with the DPBI. Regulatory liaison and data principal communications. Internal compliance monitoring. | The legal qualification of whether the incident meets the notification threshold. This memo must be prepared by external counsel to be privileged. |
In-House Counsel | Contract notifications, insurance claims, board communications, internal governance advice, regulatory correspondence as employee. | All candid legal assessments of the company's negligence, exposure, and litigation risk. These must be prepared by external counsel within a privilege framework. |
Attorney-Client Privilege as the Decisive Legal Advantage | Page 16
Conclusions And Recommendations
Summary Of Legal Propositions
This report has established the following propositions through analysis of Indian statute, Supreme Court authority, English case law, and documented GDPR enforcement outcomes.
▪ Section 126 of the Indian Evidence Act, 1872 provides absolute attorney-client privilege only for communications with enrolled, practicing advocates. In-house counsel, whose enrolment is suspended under BCI Rule 49, cannot guarantee this protection.
▪ The Dominant Purpose Test, applied by Indian and English courts, defeats privilege claims over breach investigation documents where the dominant purpose is business management or regulatory compliance rather than independent legal advice. External counsel establishes the correct dominant purpose from the outset.
▪ The forensic privilege umbrella, which is the only mechanism capable of shielding third-party forensic findings from a DPBI Section 28 production notice, can only be reliably created by an external counsel engaging the forensic firm as a legal agent under a properly drafted instruction letter.
▪ Technology consulting organizations have zero legal privilege. Their reports are fully discoverable. If those reports identify security gaps that preceded the breach, they become the DPBI's preferred evidence of the Data Fiduciary's prior knowledge of its own vulnerability.
▪ European enforcement under GDPR demonstrates with documented evidence that organizations engaging external counsel immediately and embedding them in the forensic instruction process achieve measurably better regulatory outcomes. The Marriott penalty reduction from GBP 99 million to GBP 18.4 million is the clearest financial illustration of this principle.
Conclusion
The DPO is a compliance officer, not a legal adviser for privilege purposes. The CISO is a technical professional with no legal standing in the evidence law sense. The in-house counsel is a suspended advocate whose privilege claims are fragile and regularly contested. The consulting firm holds no privilege whatsoever. External counsel is the only actor in the DPDPA breach response ecosystem who can guarantee that the organization’s most sensitive findings, its honest internal assessment of what went wrong, and why, and what it knew, remain protected from the regulator's reach. That is not a marginal advantage. It is the decisive legal difference between an investigation that informs your defense and one that becomes the prosecution's case.
Attorney-Client Privilege as the Decisive Legal Advantage | Page 17