Published: July 16, 2026
Updated: July 16, 2026
Read time: 12 minutes
You’re about to send an email about a possible compliance problem. The board is copied. Outside counsel is copied. Someone suggests putting Privileged and Confidential in the subject line and moving fast.
That label can help. It can also create false comfort.
For founders, executives, HR teams, and in-house legal staff working between Canada and the U.S., the issue isn’t what you call the document. It’s why the communication exists, who receives it, and whether it stays inside the protected legal relationship. At Mayo Law, we help clients in Toronto, the GTA, and across the border handle sensitive matters that often touch both Ontario and New York. If you get this wrong early, the cleanup is expensive and sometimes impossible.
Privilege vs Confidentiality What Is the Difference?
Privilege is a legal protection that can stop a court from forcing disclosure of certain lawyer-client communications. Confidentiality is a broader ethical duty that requires lawyers to protect client information acquired during the professional relationship, regardless of source. They overlap, but they are not the same thing.
Privilege vs Confidentiality at a Glance
| Aspect | Attorney-Client Privilege | Confidentiality |
|---|---|---|
| Definition | An evidentiary rule that prevents compelled disclosure of certain communications for legal advice | An ethical duty to protect client information |
| Scope | Narrow | Broad |
| Source of obligation | Law of evidence and privilege | Professional duty and often contract or policy |
| Who it protects | The client | The client relationship and client information generally |
| Duration | Can continue if preserved and not waived | Duties generally continue beyond the representation |
The cleanest way to think about it is this: all privileged information is confidential, but not all confidential information is privileged.
A lawyer may have a duty to keep your business records, personnel files, deal terms, or internal notes confidential. That does not mean a court must treat all of that material as privileged. The Canadian Bar Association explains the distinction this way in its discussion of privilege and confidentiality.
Why businesses mix them up
Executives often use “confidential” as if it means “safe from disclosure.” It doesn't. In disputes involving investor fallout, employee claims, or suspected fraud, that shortcut causes trouble.
Practical rule: If the communication was not made for legal advice, don't assume a confidentiality label will keep it out of evidence.
That matters in startup settings. A founder may send one email thread covering legal advice, PR messaging, HR response, and investor communications. Once business and legal purposes are blended, the analysis gets harder. The same problem shows up in trade secret disputes, where companies often over-label material while under-protecting the communications that matter. That risk appears often in matters involving trade secret misappropriation.
What Does Attorney-Client Privilege Actually Protect?
Attorney-client privilege protects the content of confidential communications between lawyer and client when the communication is made for the purpose of seeking or giving legal advice. It belongs to the client, not the lawyer, and exists to support “full and frank” communication. The Ottawa Business Journal discussion of confidential versus privileged communications captures that core point well.
The communication is protected, not the fact itself
Many clients find this surprising: If you tell your lawyer a damaging fact, the communication may be privileged. The underlying fact is not magically erased.
If a regulator, investigator, or opposing party can prove the same fact through bank records, witness testimony, contracts, or accounting files, privilege doesn't block that separate evidence. Privilege protects the conversation. It doesn't turn facts into secrets.
Telling your lawyer something doesn't make the underlying event disappear. It protects the legal consultation, not the real-world conduct.
Is all communication with a lawyer privileged?
No. A communication with a lawyer isn't automatically privileged just because a lawyer is included. The communication must be confidential in fact and made for the purpose of obtaining or providing legal advice. If the actual purpose is business planning, HR administration, or public relations, the privilege claim may fail.
What has to be present
A useful checklist is short:
- Lawyer and client relationship: The communication must stay within the protected legal relationship.
- Confidential setting: It must be intended to remain private when made.
- Legal purpose: The purpose must be getting or giving legal advice.
- Careful handling: Distribution must stay limited.
Legal advice privilege and litigation privilege are not identical
In practice, businesses often need to separate two categories.
Legal advice privilege generally protects confidential communications between lawyer and client for legal advice.
Litigation privilege can be broader. It can protect certain communications and materials created for existing or reasonably contemplated litigation. That's especially important in investigations, witness interviews, and document collection exercises tied to a potential claim or prosecution.
Where companies get into trouble is assuming every investigation memo falls into the second category. It doesn't. A workplace review prepared to improve internal controls may be important and sensitive, but that alone doesn't make it privileged. If the work is really about legal exposure, structure matters from the start. That's one reason businesses dealing with disputes often ask about work product privilege.
A simple scenario
A Toronto company discovers irregular expense claims tied to a U.S. subsidiary. The CFO writes to external counsel asking for legal advice on exposure, reporting obligations, and employee interviews. That communication has a stronger privilege basis.
Now change one fact. The CFO asks for a report “to improve processes and reassure the board before financing closes.” The legal element is still there, but the dominant purpose is now under pressure. That distinction can decide whether the document stays protected.
How Do Privilege Rules Differ Between the US and Canada?
For cross-border businesses, the headline is straightforward. The concepts are similar, but you shouldn't assume one country's privilege analysis will carry over into the other.
Both the U.S. and the UK apply a dominant purpose test for litigation privilege, and UK law strongly influences Canadian privilege analysis. Pinsent Masons' overview of legal professional privilege explains the key distinction: legal advice privilege is narrower and focused on confidential lawyer-client communications, while litigation privilege can extend more broadly in the litigation context.
Do US privilege rules apply in Canada?
Not automatically. A Canadian court applies Canadian law to the privilege issue before it, and a U.S. court applies the law relevant to that proceeding. The principles often resemble each other, but the forum matters, the record matters, and the purpose of the communication matters.
The practical difference for in-house and operating teams
Cross-border companies often run one investigation team for efficiency. The CEO is in Toronto. HR is in Mississauga. Finance is in New York. Outside consultants sit elsewhere. That's operationally normal. It can also create a privilege mess if nobody defines the legal purpose at the beginning.
A communication aimed at getting legal advice should look and behave like one. It should be directed through counsel, limited to those who need to participate, and separated from ordinary business reporting.
Where the pressure shows up
Three recurring trouble spots appear in cross-border matters:
- Mixed-purpose emails: One thread covers legal advice, employee messaging, and investor response.
- Board packages: Legal analysis is dropped into a deck prepared mainly for governance or financing.
- Investigation reports: Drafts circulate widely among business teams before counsel controls distribution.
If a report is created to solve a management problem first and a legal problem second, you should expect a privilege fight.
An anonymized scenario
A founder-led software company starts an internal review after a whistleblower complaint involving a Canadian parent and a U.S. sales office. U.S. counsel directs interviews, but the final report is written as a management memo for remediation and sent to operations, HR, and an external consultant. In the U.S., the company may argue the work was tied to anticipated litigation. In Canada, a court examining the same material may focus hard on who received it and whether it was really confined to legal advice.
That doesn't mean protection is impossible. It means cross-border consistency matters. The closer the record stays to legal advice or litigation preparation, the stronger the position.
Government procedure can also shape how businesses respond under pressure. If an investigation overlaps with immigration filings or employee mobility, official process guidance should come from sources such as USCIS and IRCC, not internal assumptions.
What Are the Biggest Risks to Losing Privilege?
The two risks that cause the most avoidable damage in cross-border matters are the business purpose trap and third-party waiver.
The business purpose trap
A common failed privilege claim arises when the communication's purpose is business risk management or HR compliance rather than legal advice. The Association of Corporate Counsel discussion of the privilege and confidentiality disclaimer problem addresses that trap directly.
This shows up constantly in internal investigations. A company says the review is “privileged and confidential,” but the documents read like an operational audit. The stated audience is management. The recommendations concern workflow, training, and reputation. Counsel is copied, but counsel is not directing the work as legal advice.
An anonymized example is typical. A startup discovers suspicious vendor payments during expansion into the U.S. The founders ask for a report “to improve business controls” before a financing round. The report includes legal comments, but it is mainly an internal business document. It is later shared with external auditors. The privilege position weakens quickly.
The third-party waiver risk
Privilege can also be lost when a protected communication is shared with someone outside the lawyer-client relationship. That can include a consultant, a foreign notary, an immigration processor, or even a family member. The Victim Rights Law Center material on attorney-client privilege, work product, and confidentiality explains this waiver risk.
This catches people in immigration and cross-border document work. A business owner receives legal advice about source of funds, ownership structure, or exposure from prior conduct, then forwards the email chain to a visa agency or document processor “for convenience.” The convenience may destroy the privilege.
Two signs you should stop and reassess
- Wide circulation: If the document is moving beyond legal decision-makers, the risk rises.
- Mixed audience: If non-legal recipients are included by default, ask why each person is there.
Mayo Law works with companies across the GTA and on cross-border matters. Joseph Mayo is licensed in Ontario and New York, so clients with U.S. ties coordinate their legal work in one place rather than juggling two firms. That structure can help when a matter touches investigations, compliance, and immediate response steps such as what to do if under federal investigation.
Best Practices for Protecting Privileged Communications
The strongest privilege practices are boring. That's good. They rely on disciplined habits, not clever labels.
Does writing Privileged and Confidential make an email privileged?
No. The label doesn't create privilege by itself. But it can still help because it signals the sender's intent that the communication is confidential and tied to legal advice. Courts care more about substance and purpose than labels, but labels are still useful practice.
What works in real files
Use a short process that people can follow:
-
State the legal purpose early
Open the message by saying legal advice is being requested or provided. -
Keep legal and business discussions separate
Use different emails or separate memos. -
Limit recipients
Send only to people who need the legal advice to perform their role. -
Don't forward without checking
Forwarding is one of the fastest ways to waive protection. -
Control attachments and drafts
A privileged memo attached to a general board package is asking for trouble. -
Involve counsel at the start of sensitive reviews
Retroactive labeling rarely fixes a poor record.
“Privileged and Confidential” is a useful signpost. It isn't a magic shield.
Sample language that helps
A practical subject line and opener can be simple:
- Subject line: Privileged and Confidential Request for Legal Advice
- Opening line: We are requesting legal advice regarding this issue. Please keep this communication confidential and do not forward without approval from counsel.
That won't save a document whose real purpose is business planning. It will, however, help establish the record when the purpose is legal.
What to do after an accidental disclosure
If a privileged email or attachment goes to the wrong person, move quickly.
- Stop further spread: Ask recipients not to review, copy, or forward the material.
- Notify counsel immediately: The response should be coordinated, not improvised.
- Document what happened: Record who received it, when, and what was sent.
- Seek return or deletion: Counsel can assess the right clawback position.
- Review your process: Fix the workflow that caused the mistake.
Cross-border companies should train HR, finance, and executive assistants on this. Many privilege losses happen through routine administration, not litigation strategy. Similar handling discipline matters in employee records and workplace investigations, especially where privacy and disclosure issues overlap with employee privacy rights.
Frequently Asked Questions
Can a board deck be privileged?
Sometimes. A board deck is more likely to support privilege when it is prepared for the purpose of obtaining or receiving legal advice and distributed narrowly. If it mainly serves governance, operations, financing, or investor relations, the privilege argument weakens. A mixed deck should usually be split into legal and business components.
Does privilege cover communications with accountants or consultants?
Not automatically. The safest assumption is that sharing a privileged communication with a third party can destroy the privilege unless a recognized legal basis applies. In practice, involve counsel before sending legal advice to an accountant, investigator, immigration processor, or outside consultant. Convenience is not a legal strategy.
How much does it cost to fix a privilege problem?
There's no standard fee because the response depends on the mistake, the forum, and whether litigation or an investigation is already underway. The expensive part is usually not the email itself. It's the downstream fight over production, waiver, and damage control. Prevention is usually cheaper than trying to rebuild a broken record.
How quickly should a company structure privilege in an internal investigation?
Immediately. The first emails, interview instructions, and draft scopes often become the evidence used to test purpose. If the initial record reads like operations or HR housekeeping, later attempts to reframe it as legal advice are harder to defend. Early discipline matters more than polished wording later.
Does privilege change if the matter involves both Ontario and New York?
Yes, in the sense that the forum and governing law affect how the issue is analyzed. You should expect scrutiny on purpose, confidentiality, and who received the communication. Cross-border companies often save time and cost by getting the privilege structure right once, instead of asking separate teams to fix it later.
Are immigration documents ever privileged?
Some communications with counsel about immigration strategy can be privileged if they meet the legal advice test. But forms, supporting records, and materials sent to government bodies are a different category. If you're building a new venture or preparing filings, legal planning should be separated from operational drafting. That issue comes up often for founders working with a startup business attorney.
If you're dealing with a sensitive internal issue, a cross-border filing, or an investigation that could expose internal communications, getting the structure right early matters. Mayo Law advises businesses, founders, and professionals on how to separate legal advice from business communications before waiver becomes the core issue.
Sensitive communications usually go off track for ordinary reasons. Someone copies too many people, mixes legal and business advice, or forwards a message to a third party who didn't need it. If you slow down at that moment and ask what the communication is really for, you'll make better decisions.
How Mayo Law Can Help
A common failure point looks ordinary at first. A founder asks counsel for legal advice on a US and Canada rollout, then copies a consultant, accountant, or foreign affiliate to keep the project moving. Later, the record reads like a business coordination thread, not a request for legal advice, and the privilege argument gets harder.
Mayo Law advises clients across Toronto, the GTA, and on cross-border matters where that risk is real. The job is to set up communications so they are created for a legal purpose, sent only to the people who need to receive them, and handled in a way that does not invite a third-party waiver argument.
That often means separating legal analysis from commercial discussion, limiting distribution, and deciding early who should and should not be on the email chain. In cross-border files, those choices matter because a communication that looks protected in one setting can face closer scrutiny once it is shared across teams, entities, or outside advisors.
If a sensitive issue is developing, get legal counsel involved before the document trail forms around business execution. That is usually the point where the business purpose trap starts.
Disclaimer
This article is for informational purposes only and does not constitute legal advice. Every situation is different. Consult a licensed lawyer about your specific circumstances. Mayo Law provides legal services through Mayo Law PC in Ontario and Joseph Mayo PLLC in New York.
Related Articles
- Business immigration legal services
- White collar defence and investigations
- Regulatory compliance legal services
