Protection of privileged material: what to do in the first ten days depends on three actions completed before the seized files, laptops or email accounts reach an investigator's desk: identify everything that was taken, assert privilege in writing before any review starts, and secure a court ruling on anything the prosecution disputes.
Who this concerns
The situation arises the moment Ekobrottsmyndigheten, Skatteverket or the police execute a search and take documents, devices or email accounts from a company under investigation for an economic offence, tax offence, market abuse or corruption matter. It concerns the company itself, its board and any employee whose device was seized, and it concerns in-house counsel and any external Swedish counsel already engaged, because the strength of the protection depends on who created the material and in what capacity.
It also concerns foreign parent companies with a Swedish subsidiary. A seizure at the subsidiary routinely captures correspondence with a foreign group general counsel, shared drives synced to servers outside Sweden, and communications that were never intended to sit in a Swedish investigation file. Certain sectors see this pattern more often than others, and a broader view of which activities attract this kind of attention sits in sector-specific exposure to economic crime enforcement.
What the law says
Under Swedish law as it currently stands, material may not be seized, and if seized may not be examined, if its content is of a kind that a person could not be compelled to disclose as a witness. The core application of this is correspondence between a suspect and defence counsel engaged for that specific matter. The protection attaches to the substance of the communication, not to the label on the file, and it is not automatic: a party that says nothing when material is taken has, in practice, allowed the review to proceed.
The strength of this protection is not uniform across advisers. Communications with an advokat acting as defence counsel receive the broadest protection recognised in Swedish procedure. Communications with in-house counsel, compliance staff, or advisers who are not members of the Swedish Bar sit on weaker ground, and whether they are protected at all depends on the specific function the adviser was performing when the material was created.
Where the parent company, the servers, or the relevant counsel sit outside Sweden, three things change. First, a foreign general counsel's advice to a Swedish subsidiary is assessed under Swedish rules on privilege regardless of how it would be treated in the parent's home jurisdiction. Second, material physically stored on a server abroad can still be captured if a Swedish-controlled account or device provides access to it, which means the location of the server offers no protection on its own. Third, if documents genuinely exist only abroad and Swedish authorities want them, that typically runs through a separate cross-border request, which sits outside the ten-day window addressed here. None of this substitutes for a considered view of how liability actually flows inside a group; that question is addressed separately in how liability moves through a group with a foreign parent.
How it works in practice
Day one: reading the seizure protocol correctly
The protocol produced at the time of seizure lists what was taken, in what form, and sometimes flags material that the executing officer has already segregated as potentially sensitive. Read it line by line against what was actually in the room or on the device. A protocol that says "email account" without specifying date ranges or folders is functionally an unlimited seizure until someone narrows it.
What actually counts as privileged under Swedish practice
Not every document touched by a lawyer qualifies. Advice on a commercial contract, a compliance memo circulated for general awareness, or a board pack prepared before any investigation existed will usually not qualify, even if a lawyer's name is on it. Material created specifically to obtain or give advice on the defence of this particular matter is the material that has a real claim.
Asserting privilege before anyone opens the file
Silence is treated as consent to review. The assertion needs to identify, as precisely as possible, which items are claimed as privileged and why, and it needs to reach the investigating authority before the file, the mailbox, or the imaged drive is examined. A blanket claim over an entire mailbox without any attempt to identify the privileged subset invites the authority to simply proceed and let a court sort it out later, on the authority's timetable rather than the company's.
Sealed material: who holds it and for how long
Once a claim is made, disputed material is typically sealed rather than reviewed, pending a decision on the claim. Sealing is a practical safeguard, not a resolution. It stops the clock on examination; it does not return the material and it does not decide the question.
When the investigating authority disagrees
Disagreement is the default outcome for anything genuinely borderline, not the exception. An investigator who has taken thousands of documents will rarely accept a company's own characterisation of what is privileged without independent testing of that claim.
Getting a court ruling on disputed material
Where the parties cannot agree, the matter goes to the district court for a ruling on whether the disputed material may be examined. This is the mechanism that actually protects the material, not the initial letter asserting the claim. The letter buys the sealing; the court decides the outcome.
In-house counsel and foreign group counsel: a different standard
Material generated by in-house counsel, or by a group counsel based abroad, is assessed on the function performed, not the job title held. A foreign general counsel's day-to-day involvement in commercial matters for the group will not convert into privilege the moment an investigation starts; the material has to have been created for the purpose of the defence.
Cross-border data and servers held outside Sweden
Where the Swedish entity has access to material stored on a foreign server, that access is what matters for seizure, not the server's physical location. Reporting obligations that sit alongside a criminal exposure, for example where the same facts trigger a separate notification duty, follow their own clock; the two do not merge into one deadline. The mechanics and figures for that separate obligation are set out in incident reporting deadlines and figures.
What to check in the first ten days
- Whether the seizure protocol lists individual documents or entire mailboxes, drives and devices.
- Whether any material is already marked as sealed or segregated by the executing officer.
- Which custodians' accounts or devices were taken, and whether any of them include a defence counsel's correspondence.
- Whether the written assertion of privilege reached the investigating authority before any review began, and whether there is proof of that timing.
- Whether any material claimed as privileged was created by someone who is not an advokat, and if so, what function they were performing.
- Whether any of the seized material is also accessible from a server located outside Sweden.
Does a communication with a foreign group general counsel count as privileged in Sweden?
It is assessed under Swedish rules regardless of where the general counsel sits, and the outcome turns on whether the communication was created for the purpose of the Swedish defence, not on the counsel's title or jurisdiction. Group-wide legal advice on unrelated commercial matters generally will not qualify.
Is there a fixed statutory deadline for asserting privilege after a seizure?
No fixed number of days is set out for making the claim itself. The practical urgency comes from the fact that review can begin as soon as the authority chooses to proceed, and once material has been examined the claim is largely academic. Other obligations that arise from the same facts, such as separate notification duties, run on their own clock and are addressed where those figures are set out.
What happens if the company and the prosecutor disagree about what is privileged?
The disputed items are typically sealed and the disagreement goes to a court for a ruling; it does not resolve informally between the parties. The pattern is similar to disputes that cannot proceed on an accelerated basis and instead require a full hearing on the merits, described in more detail in why disputed claims cannot take the summary route.
The numbers
Ten days is a planning horizon, not a figure written into the law as a deadline for asserting privilege. What actually drives how long the position takes to settle, and what it costs to settle it, is the volume of material seized, the number of custodians whose accounts or devices were taken, and how cleanly privileged material can be separated from everything else.
A seizure limited to a handful of files from one device resolves quickly because there is little to sort and little room for genuine disagreement. A seizure of full mailboxes across several custodians, spanning years and mixing commercial correspondence with anything touching the investigation, takes longer for a structural reason: someone has to go through the material folder by folder before a credible claim can even be formulated, and a broad, unsubstantiated claim over an entire account is the one approach most likely to be rejected outright.
Cost follows the same logic. It rises with the number of documents that require individual review, with the need for an independent reviewer to filter material before the investigating authority sees it, and with whether the dispute proceeds to a court hearing rather than being resolved by agreement on the scope of the claim. None of this is quantifiable in advance in the abstract; it becomes quantifiable once the seizure protocol and the volume of material are actually in front of someone reviewing them.
Where it usually goes wrong
The claim fails, or is weakened, in a small number of recurring situations. Material shared with a third party outside the privileged relationship, including circulating legal advice internally beyond those who needed it for the defence, is treated as disclosed and loses the protection it might otherwise have had. Advice that mixes a commercial recommendation with a legal opinion is examined for its dominant purpose, and material created mainly to run the business rather than to defend against the investigation will not qualify simply because a lawyer drafted it.
Timing defeats claims as often as substance does. An assertion made after the authority has already reviewed the material addresses a fact that has already happened; sealing after review is not the same as sealing before it. A claim asserted for the first time at a court hearing, with no earlier written notice to the investigating authority, invites the obvious question of why it was not raised when the material was seized.
The distinction between an advokat and other advisers is not a technicality that disappears under pressure. In-house counsel's advice, however senior the role, is tested against the same purpose-based standard as any other internal document, and a foreign general counsel's involvement in day-to-day commercial matters for the group does not, by itself, convert into a defence-privileged relationship once an investigation starts. Companies that assume seniority or job title settles the question are the ones most often surprised by the court's ruling.
Finally, a broad claim covering an entire account or device, made without any attempt to identify the disputed subset, tends to be treated as an attempt to delay rather than a genuine assertion, and courts respond accordingly. A narrower, specific claim over identifiable material is what actually gets tested on the merits.
What to do next
This covers the mechanics of the first ten days: reading the protocol, asserting the claim, and understanding where the standard is weaker than assumed. It does not replace a review of the actual seizure protocol against the material that was in the building or on the device, which is where the real position gets built. Where the same investigation also touches assets that were frozen or seized rather than just documents, the parallel first-ten-days sequence for that is set out in asset seizure and forfeiture: the first ten days.
Where a claim needs to be formulated against a specific protocol, that is an assessment of the actual documents, not a general description of the mechanism. Get in touch to have the position assessed.