The first port of call following a data breach should be a specialist lawyer who can coordinate a response under the protection of legal professional privilege, one insurance partner says.