Privilege protects confidential communications between a client and its lawyer made for the purpose of obtaining or providing legal advice. Inside an organisation, each of those elements raises a question.
Who is the client. The entity, not the individual employees. Communications with employees can be privileged where they concern matters within the scope of their duties and are made to enable legal advice to the company — but the privilege belongs to the company, which may waive it. Employees frequently misunderstand this, which is why investigation interviews open with an explanation.
Legal advice, not business advice. In-house counsel often wear both hats, and communications that are predominantly commercial are not privileged merely because a lawyer was copied. The test is the predominant purpose. Copying counsel on an operational email does not protect it.
Confidentiality maintained. Circulating advice widely inside the company, or to any third party without a common interest, can waive it. Forwarding a legal memorandum to a business partner is a familiar way to lose protection.
Subject-matter waiver. Disclosing part of a privileged communication can waive protection for the rest of the subject matter — a serious risk when a company selectively discloses to make a point.
Practical guidance. Keep legal advice in communications whose purpose is plainly legal, limit distribution to those who need it, mark it, and treat any decision to disclose to a regulator as a deliberate waiver decision made in advance rather than a step taken in the moment.