I’ll simplify. As a general rule, subject to many, many exceptions, no privileges attaches when somebody in the room is not a lawyer (or an employee of the lawyer). It depends a bit on who the two people are in the case of a corporation, of course.
When you refuse to produce documents on privilege grounds, you (as the lawyer) normally have to generate something called a privilege log. It identifies each document very generally. For example, in Florida the rule (which is broadly similar to the federal rule and those of other states) is:
[QUOTE=Florida Rules of Civil Procedure]
When a party withholds information otherwise discoverable under these rules by claiming that it is privileged or subject to protection as trial preparation material, the party shall make the claim expressly and shall describe the nature of the documents, communications, or things not produced or disclosed in a manner that, without revealing information itself privileged or protected, will enable other parties to assess the applicability of the privilege or protection.
[/QUOTE]
Usually, you identify the date, author, and general subject matter of the document. If it’s an e-mail, you’d also identify the recipient. However, sometimes privilege is “category specific,” rather than “document specific.” In other words, the application of the privilege - or at least the basis of the claimed privilege - is obvious so you don’t have to identify the documents.
For example, you wouldn’t have to specifically identify your medical records to assert a privilege in a breach-of-contract case unrelated to injuries or medical care. It is clear that the doctor-patient privilege applies to your medical records in such a case regardless of what the records say or when they were generated.
Now, if you assert a document-specific privilege and the other side doesn’t agree that the document is privileged, they ask the court to compel you to produce the document(s). Normally the judge will perform in camera (that is, alone in chambers and off the record) review of contested documents and decide whether they should be produced or not.
ETA: A company being sued can’t be subpoenaed. Subpoenas are issued on third parties. Discovery requests addressed to the parties themselves are called “requests for production,” “requests for inspection,” or other similar terms.