DisputesPractice area
Cross-Border Evidence Preservation & Privilege Coordination
When a dispute, investigation or cyber incident spans jurisdictions, early decisions about information can shape both the response and the risk. A coordinated approach can help decision-makers address preservation, access, review and privilege questions across the locations that matter.
The starting point
Make the next decision with the commercial context in view.
Cross-border matters can put several legitimate obligations and risks in tension. A business may need to prevent loss of potentially relevant material while also considering data-protection, confidentiality, employment, blocking, secrecy, cybersecurity, contractual and procedural constraints. Privilege may be treated differently between the place where a communication was created, where it is held, and the forum in which it may later be sought. The immediate management question is rarely only “what documents do we have?” It is whether the organisation can identify relevant information sources, stabilise them proportionately, preserve a defensible record of decisions, and obtain local input before collection, transfer, disclosure or production. International cooperation mechanisms may be relevant in some civil or commercial matters: for example, the Hague Evidence Convention provides a framework for Letters of Request between Contracting States, subject to its terms and the law of the State of execution. The appropriate route, scope and timetable remain matter- and jurisdiction-specific.
How we help
The work around the decision.
01
Matter and jurisdiction mapping.
Where proceedings, regulatory engagement, an investigation or a threatened claim is identified, map the relevant forums, entities, custodians, systems, data locations, deadlines and information-control constraints.
02
Proportionate preservation design.
Where there is a credible preservation issue, consider an appropriately scoped preservation plan for relevant information sources, including collaboration platforms, mobile devices, cloud environments, backup arrangements and third-party-held data, while documenting key assumptions and decisions.
03
Cross-border collection and transfer assessment.
Before collecting or moving personal, confidential or regulated data across borders, identify the proposed flows, recipient roles, transfer mechanisms and local restrictions that may require further assessment. For EU personal data, Article 48 of the GDPR addresses recognition or enforceability of certain third-country orders requiring transfer or disclosure.
04
Privilege and confidentiality protocol.
Where legal advice, investigations or sensitive business communications are involved, establish a protocol to identify potentially protected material, separate review populations, control circulation, record the basis for treatment and coordinate local-law input. Under Article 11 of the Hague Evidence Convention, a person may refuse evidence in certain circumstances based on a privilege or duty under the law of the State of execution or State of origin, subject to the Convention’s conditions.
05
Review, redaction and production governance.
If disclosure, production or a response to a formal request is contemplated, develop a review structure that can address relevance, responsiveness, confidentiality, personal data, privilege claims, redactions, quality control and an auditable decision record.
06
Incident-response evidence preservation.
Where a cyber incident may give rise to claims, regulatory inquiries or notifications, align technical containment and recovery decisions with the need to preserve reliable records, system artefacts and decision logs. International instruments, including the Budapest Convention framework, illustrate the importance placed on cooperation in cybercrime matters; their application depends on State participation and applicable domestic law.
07
Third-party and vendor coordination.
Where service providers, former employees, affiliates, e-discovery providers or cloud operators hold relevant information, clarify contractual rights, security requirements, retention practices, access pathways and escalation ownership before seeking material.
08
Executive governance and communications.
Where senior stakeholders need to make rapid decisions, establish decision rights, escalation routes, a common chronology and a communication plan designed to limit unnecessary distribution of sensitive material while supporting informed oversight.
Context for the decision
The facts and records that shape the route.
What should trigger a cross-border preservation assessment?
The trigger is fact-specific. It may arise when a dispute, regulatory contact, investigation, incident, notice, contractual demand or other event creates a realistic prospect that information could become relevant. The appropriate scope and timing depend on applicable duties, the likely forums, the nature of the information and the organisation’s systems. Early triage can help distinguish routine retention from a focused response; it is not a substitute for jurisdiction-specific advice.
Can we preserve information before deciding what must be disclosed?
Often, preserving potentially relevant material and deciding whether, when or how it may be collected, transferred or disclosed are separate questions. A cautious initial step may be to prevent avoidable deletion or alteration while the legal and technical position is assessed. That approach must still be proportionate and account for security, privacy, employment, contractual and local-law considerations.
Does privilege apply consistently across all countries and forums?
Not necessarily. The availability, scope, owner, waiver rules and procedural treatment of legal professional privilege, work-product protection and comparable confidentiality protections may vary. The Hague Evidence Convention itself addresses defined circumstances in which a person may refuse evidence based on privilege or a duty under the law of the State of execution or origin. Communications should not be labelled “privileged” on the assumption that the label alone determines their treatment elsewhere.
Questions, not prescriptions
What may matter.
What should trigger a cross-border preservation assessment?
The trigger is fact-specific. It may arise when a dispute, regulatory contact, investigation, incident, notice, contractual demand or other event creates a realistic prospect that information could become relevant. The appropriate scope and timing depend on applicable duties, the likely forums, the nature of the information and the organisation’s systems. Early triage can help distinguish routine retention from a focused response; it is not a substitute for jurisdiction-specific advice.
Can we preserve information before deciding what must be disclosed?
Often, preserving potentially relevant material and deciding whether, when or how it may be collected, transferred or disclosed are separate questions. A cautious initial step may be to prevent avoidable deletion or alteration while the legal and technical position is assessed. That approach must still be proportionate and account for security, privacy, employment, contractual and local-law considerations.
Does privilege apply consistently across all countries and forums?
Not necessarily. The availability, scope, owner, waiver rules and procedural treatment of legal professional privilege, work-product protection and comparable confidentiality protections may vary. The Hague Evidence Convention itself addresses defined circumstances in which a person may refuse evidence based on privilege or a duty under the law of the State of execution or origin. Communications should not be labelled “privileged” on the assumption that the label alone determines their treatment elsewhere.
Does a foreign order automatically permit data disclosure?
No general answer is safe. Recognition, enforceability and lawful transfer may depend on the forum, the type of order, applicable treaties or other international arrangements, data-protection rules, secrecy or blocking rules, and the circumstances of the request. Article 48 of the GDPR states that a third-country court or administrative decision requiring a controller or processor to transfer or disclose personal data may be recognised or enforceable only where it is based on an international agreement, without prejudice to other transfer grounds in that Chapter. Local advice is needed before acting on a particular demand.
How can management improve control without slowing the response?
Management can identify a single accountable lead, define who can approve preservation, collection, transfer and external communications, and require a concise decision log. A short, shared fact record—covering systems, locations, custodians, deadlines, requests and unresolved legal issues—can help teams coordinate without circulating unnecessary sensitive detail. The structure should be tailored to the matter and revised as facts develop.
Begin with context
Put the decision into focus.
For an initial conversation, share only high-level, non-confidential context about the relevant business decision, markets, parties, documents and timetable. Do not send confidential, privileged, personal or time-sensitive material through a website enquiry.Legal information only. This page provides general legal information, not legal advice. It does not address the facts of any individual matter and does not create a lawyer-client relationship. The appropriate route, framework, timing and outcome depend on the applicable law, documents and circumstances.