--- title: "Privileged Comms Guide: physical protection | Firevault" description: "Legal professional privilege is absolute in UK law. But privilege can be waived through inadequate protection of privileged material. When privileged…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/guides/privileged-communications-physical-protection#webpage", "url": "https://fire-vault.com/learn/guides/privileged-communications-physical-protection", "name": "Privileged Comms Guide: physical protection", "description": "Legal professional privilege is absolute in UK law. But privilege can be waived through inadequate protection of privileged material. When privileged…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/guides%2Fprivileged-communications-physical-protection.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/guides/privileged-communications-physical-protection#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/guides/privileged-communications-physical-protection#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Guides", "item": "https://fire-vault.com/learn/knowledge?filter=guides" }, { "@type": "ListItem", "position": 4, "name": "Privileged Communications: Physical Protection", "item": "https://fire-vault.com/learn/guides/privileged-communications-physical-protection" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Privileged Communications: Physical Protection", "description": "Legal professional privilege is absolute in UK law. But privilege can be waived through inadequate protection of privileged material. When privileged documents are stored on connected systems, every breach creates a potential waiver argument.", "url": "https://fire-vault.com/learn/guides/privileged-communications-physical-protection", "image": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/guides%2Fprivileged-communications-physical-protection.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@id": "https://fire-vault.com/#organization" }, "datePublished": "2026-02-19T09:16:21.25498+00:00", "dateModified": "2026-08-28T07:05:10.849702+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/learn/guides/privileged-communications-physical-protection" }, "inLanguage": "en-GB", "articleSection": "Legal", "wordCount": 536, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview Privilege Is BinaryThe Digital Privilege ProblemThe SRA and Professional StandardsWhat Privileged Material Belongs…How OSS Protects PrivilegeThe Evidential AdvantageConclusionMore [Guides](/learn/knowledge?filter=guides)/ Legal Legal · 19 February 2026 # Privileged Communications: Physical Protection Legal professional privilege is absolute in UK law. But privilege can be waived through inadequate protection of privileged material. When privileged documents are stored on connected systems, every breach creates a potential waiver argument. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 3 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Flearn%2Fguides%2Fprivileged-communications-physical-protection)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Flearn%2Fguides%2Fprivileged-communications-physical-protection&text=Privileged%20Communications%3A%20Physical%20Protection%0A%0ALegal%20professional%20privilege%20is%20absolute%20in%20UK%20law.%20But%20privilege%20can%20be%20waived%20through%20inadequate%20protection%20of%20privileged%20material.%20When%20privileged%20documents%20are%20stored%20on%20connected%20systems%2C%20every%20breach%20creates%20a%20potential%20waiver%20argument.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Flearn%2Fguides%2Fprivileged-communications-physical-protection)[](mailto:?subject=Privileged%20Communications%3A%20Physical%20Protection&body=Legal%20professional%20privilege%20is%20absolute%20in%20UK%20law.%20But%20privilege%20can%20be%20waived%20through%20inadequate%20protection%20of%20privileged%20material.%20When%20privileged%20documents%20are%20stored%20on%20connected%20systems%2C%20every%20breach%20creates%20a%20potential%20waiver%20argument.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Flearn%2Fguides%2Fprivileged-communications-physical-protection) ![Privileged Communications: Physical Protection](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/guides%2Fprivileged-communications-physical-protection.jpg) Legal Why it matters ## What this means for organisations holding critical data Legal professional privilege is absolute in UK law. But privilege can be waived through inadequate protection of privileged material. When privileged documents are stored on connected systems, every breach creates a potential waiver argument. **On this page**[Privilege Is Binary](#section-0)[The Digital Privilege Problem](#section-1)[The SRA and Professional Standards](#section-2)[What Privileged Material Belongs…](#section-3)[How OSS Protects Privilege](#section-4)[The Evidential Advantage](#section-5)[Conclusion](#section-6) On this page 1. [Privilege Is Binary](#section-0) 2. [The Digital Privilege Problem](#section-1) 3. [The SRA and Professional Standards](#section-2) 4. [What Privileged Material Belongs Offline](#section-3) 5. [How OSS Protects Privilege](#section-4) 6. [The Evidential Advantage](#section-5) 7. [Conclusion](#section-6) ## Privilege Is Binary Legal professional privilege in England and Wales is one of the strongest protections in the common law system. It prevents compelled disclosure of communications between a client and their legal adviser made for the purpose of obtaining or giving legal advice. But privilege is binary. It exists absolutely, or it does not exist at all. And one of the ways privilege can be lost is through inadequate steps to maintain confidentiality. If privileged material is stored on systems that are subsequently breached, the question of whether privilege has been waived becomes a genuine legal risk. ## The Digital Privilege Problem Modern legal practice generates privileged material digitally. Legal advice, investigation reports, litigation strategy documents, and settlement negotiations all exist as digital files stored on connected systems. When those systems are breached, several problems emerge: - **Exposure risk:** Privileged material may have been accessed or exfiltrated by the attacker - **Waiver arguments:** Opposing parties may argue that inadequate security measures constituted a failure to maintain confidentiality - **Disclosure obligations:** Organisations may face obligations to disclose that privileged material was potentially compromised - **Insurance implications:** Privilege waiver can affect the organisation's ability to resist disclosure in related litigation ## The SRA and Professional Standards The Solicitors Regulation Authority (SRA) requires law firms to take reasonable steps to protect client confidentiality. The Bar Standards Board imposes similar obligations on barristers. In-house legal teams are subject to the same professional standards through their individual practising obligations. What constitutes "reasonable steps" evolves with the threat landscape. As cyber attacks become more prevalent and sophisticated, the standard of reasonable protection rises accordingly. Physical controls for the most sensitive privileged material represent the current highest standard. ## What Privileged Material Belongs Offline - **Internal investigation reports:** Legal advice on potential misconduct, regulatory breaches, or litigation risk - **Litigation strategy documents:** Case assessments, settlement authorities, and tactical planning - **Board legal briefings:** Legal advice to the board on significant transactions, disputes, or regulatory matters - **M&A legal analysis:** Due diligence findings, risk assessments, and deal structure advice - **Regulatory response materials:** Legal advice on regulatory investigations, enforcement actions, or compliance reviews ## How OSS Protects Privilege [Offline Secure Storage](/offline-secure-storage)® provides the physical protection that privilege demands: - **No remote access:** Privileged material in [physically disconnected storage](/storage) cannot be accessed through any network-based attack - **Identity-verified access:** Every access to privileged material requires physical presence and identity verification, creating an audit trail of who accessed what and when - **Demonstrable protection:** Physical disconnection provides evidence of "reasonable steps" that satisfies professional obligations and resists waiver arguments - **Breach scope exclusion:** Data stored offline is excluded from breach impact assessments, preserving privilege even when connected systems are compromised ## The Evidential Advantage In litigation or regulatory proceedings, an organisation that can demonstrate privileged material was stored in physically disconnected storage with identity-verified access holds a significantly stronger position than one whose privileged material was on a server that was breached. The physical control demonstrates the intent and effort to maintain confidentiality that privilege requires. ## Conclusion Legal privilege is too important to entrust to software controls alone. Physical disconnection through OSS provides the level of protection that privilege demands, the evidence of reasonable steps that professional obligations require, and the certainty that privileged material survives cyber incidents with its protected status intact. About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. [Get started](/get-started)[Talk to the team](/demo) **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful [ ![Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg) Insight ### Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London Stansted. Most of it came from free terminal WiFi sign-ups and from car parking, lounge and fast-track bookings. 27 Aug 2026 5 min ](/news/manchester-airports-group-data-breach-87-million-customers-2026)[ ![Premier League moves the goalposts as cyber rulebook introduces 22 security control areas](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/premier-league-cyber-rulebook-2026.jpg) Regulation ### Premier League moves the goalposts as cyber rulebook introduces 22 security control areas Rule J.9 and Appendix 11 put cyber security into the Premier League rulebook, with phased deadlines, annual evidence and 22 control areas spanning club, stadium and supplier operations. 27 Aug 2026 14 min ](/news/premier-league-cyber-rulebook-appendix-11-2026)[ ![T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there.](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/tmobile-power-pull-salt-typhoon-2026.jpg) Insight ### T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there. T-Mobile's security chief ended months of failed software remediation by driving to the data centre, clearing ID, finding the cabinet and physically pulling the power supply from the compromised hardware. Disconnection was the right control. Firevault Control is designed to take the same action in under six milliseconds. 27 Aug 2026 7 min ](/news/tmobile-severs-network-cable-salt-typhoon-hackers-2026) ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Put this guide into practice Ready to apply what you have learned? Explore how Firevault delivers the offline protection covered in this guide. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up