The first hours matter more than the first draft response
When an international company receives a U.S. subpoena, civil investigative demand, administrative request, regulator inquiry, or other formal demand, management’s first instinct is often to ask what documents must be produced. That question matters, but it is not the first question. The first task is control. The company should preserve potentially relevant information, identify the legal entity and personnel involved, centralize communications, protect privilege, and prevent well-intentioned employees from deleting, moving, translating, or “cleaning up” records. Cross-border investigations become difficult quickly because data may sit in multiple countries, on personal devices, in cloud systems, or with third-party service providers. A disciplined response structure established immediately can prevent avoidable problems later.
Identify exactly what the government sent and to whom
Not every government communication carries the same legal significance. Companies should determine the issuing authority, statutory or procedural basis, recipient entity, service method, response deadline, scope, and whether the request is compulsory or voluntary. A request directed to a U.S. subsidiary may create different issues from one directed to a foreign parent. A regulator inquiry may operate differently from a grand-jury subpoena or an administrative subpoena. Management should avoid substantive responses until U.S. counsel has identified the instrument and applicable obligations. Operational teams can still begin preservation and information mapping while legal analysis proceeds.
Issue a focused preservation hold before collecting everything
Preservation should be prompt but intelligent. The company needs to identify likely custodians, relevant date ranges, data sources, messaging platforms, shared drives, email accounts, mobile devices, and third-party repositories. Automatic deletion settings, ephemeral messaging, device replacement, and routine backup cycling may need to be suspended. Cross-border companies should also identify local employment, privacy, data-protection, secrecy, or blocking-law issues that may affect access, transfer, or review. Preservation does not always require immediate movement of data into the United States. In many cases, preserving data in place while counsel develops a lawful collection plan is the safer approach.
Build a data map before building a production set
International companies often underestimate how fragmented their information is. Headquarters may control email while a local subsidiary controls accounting. Employees may use WhatsApp, Teams, Signal, Slack, local messaging applications, or personal devices for business communications. Sales records may be held by a distributor. Cloud servers may be hosted in another jurisdiction. A data map should identify systems, custodians, locations, retention rules, access controls, and ownership. This allows counsel to understand both responsiveness and transfer constraints. It also makes later negotiations with the government more credible because the company can explain what information exists and how it is maintained.
Do not let document production destroy legal privilege
Cross-border matters frequently involve multiple law firms, in-house counsel, consultants, accountants, translators, and local advisers. Privilege rules differ across jurisdictions, and communications that management assumes are protected may not be treated the same way everywhere. U.S. counsel should establish privilege protocols for the investigation and production process. Teams should separate business advice from legal advice where practical, mark legal workstreams appropriately, control distribution, and avoid casual forwarding of legal analyses. Consultants working at counsel’s direction may require specific engagement structures. Privilege should be designed into the response process rather than reconstructed after documents have already circulated widely.
Collection and review should be proportional to the actual demand
A common operational failure is to collect far more information than the request requires, creating cost and unnecessary exposure. Another is to collect too narrowly and discover gaps late in the process. The right approach is iterative: understand the demand, identify relevant custodians and systems, test targeted searches, review samples, refine terms, and document decisions. Where a request is extremely broad, counsel may be able to discuss scope, sequencing, formats, custodians, or timing with the government. Companies should preserve broadly enough to protect against spoliation while collecting and reviewing in a disciplined way. Preservation scope and production scope are not necessarily identical.
Cross-border transfer issues should be surfaced early, not used as a last-minute excuse
Foreign privacy and data laws can create genuine constraints, but they are most effective when addressed early and specifically. The company should identify which categories of data are affected, what transfer mechanisms or employee notices may be required, whether local counsel should advise, and whether review can occur locally before responsive material is transferred. General statements that “foreign privacy law prevents production” are rarely useful without detailed legal support. At the same time, U.S. demands should not be treated as automatically overriding foreign legal obligations. The company needs coordinated advice that considers both systems and develops a defensible path to compliance.
Interviews and internal fact development should be coordinated with the production strategy
Documents rarely answer every question. Management may need to understand what happened before deciding whether to make representations to the government, discipline employees, remediate controls, or consider voluntary disclosure. Internal interviews should therefore be coordinated with document review and conducted under a clear legal framework. Interviewers should know what documents exist, what facts remain uncertain, and what jurisdictions are involved. Employees should not be coached on substance, but they should receive appropriate instructions regarding preservation and confidentiality. In multinational organizations, translation quality and cultural context can materially affect fact development.
Current DOJ policy makes cooperation and remediation strategically important
In March 2026, the Department of Justice issued a Department-wide corporate enforcement policy for criminal matters. The policy creates incentives for voluntary self-disclosure, cooperation, and timely remediation, subject to its terms and exceptions. That does not mean every company receiving a subpoena should self-disclose additional conduct. It does mean management and counsel should understand early whether the facts may implicate broader misconduct and what choices could affect enforcement outcomes. The decision requires reliable fact development, not reflexive disclosure or reflexive silence. Axon Point Advisory can support internal information management, document review, compliance remediation, and cross-border coordination under the direction of appropriate legal counsel.
Establish one response authority and one factual record
International investigations become unmanageable when business units communicate separately with the government, outside counsel, auditors, insurers, or counterparties. The company should designate a response leader and maintain a controlled chronology of requests, productions, representations, decisions, and unresolved issues. This does not mean that every operational task must be centralized, but material communications and factual statements should be coordinated. A consistent record reduces the risk of contradictory explanations and allows management to understand what the company has already represented. It also helps identify when new facts require correction or supplemental production. In a cross-border matter, disciplined governance of the response process can be as important as the technical document review.
Frequently Asked Questions
Should employees start sending responsive documents to management immediately?
Usually the safer first step is preservation and controlled collection. Unstructured forwarding can alter metadata, create duplication, and expose privileged material.
Does storing data outside the United States mean it cannot be requested?
No. Data location is only one part of the analysis. U.S. legal authority, entity control, and foreign legal restrictions all need to be assessed.
Should a company conduct an internal investigation after receiving a subpoena?
Often some level of internal fact development is necessary, but scope and privilege should be directed by qualified counsel.
Selected official sources
U.S. Department of Justice, Department-wide Corporate Enforcement Policy, March 10, 2026.
U.S. Department of Justice, current Criminal Division corporate enforcement materials, updated July 2026.
Relevant issuing-agency subpoena rules and governing law should be reviewed for each specific matter.
This article is provided for general informational and business-advisory purposes and does not constitute legal advice. Laws, regulations, sanctions, and enforcement policies change. Legal advice should be obtained from appropriately licensed counsel for a specific matter.