Contents
- The three phases of M&A and GDPR
- Phase 1: Due diligence – sharing data
- Data room – a GDPR-compliant approach
- Legal basis for sharing in due diligence
- Phase 2: Deal execution (signing → closing)
- Phase 3: Post-integration
- Inherited GDPR liability
- GDPR due diligence checklist
- The most common mistakes in M&A and GDPR
- Practical timeline
- Frequently asked questions
Mergers and acquisitions (M&A) are among the most complex business transactions – and GDPR complicates the process even further. Every M&A transaction involves the exchange and processing of significant volumes of personal data: of employees, customers, suppliers and counterparties. Without proper planning and a GDPR-compliant process, you risk not only fines but the failure of the deal itself. Below we examine each phase of M&A through the lens of personal data protection.
The three phases of M&A and GDPR
From a GDPR perspective, the M&A process is divided into three phases, each with different legal bases, obligations and risks:
| Phase | Main legal basis | Key GDPR risk |
|---|---|---|
| Due Diligence | Legitimate interest (Art. 6(1)(f)) | Excessive disclosure of personal data in the virtual data room |
| Execution | Contract (Art. 6(1)(b)) + legal obligation (Art. 6(1)(c)) | Failure to inform data subjects (employees, customers) |
| Post-integration | Various – depends on the specific processing | Inherited liability + incompatible systems |
Phase 1: Due diligence – sharing data
In due diligence, the buyer (or its advisers) obtains access to information about the target company in order to assess the risks and the value. This information inevitably includes personal data:
What personal data is exchanged in due diligence
| Category | Examples | GDPR risk |
|---|---|---|
| Employee data | Names, positions, salaries, length of service, bonuses, appraisals | High – sensitive HR information |
| Data on key persons | Managers, procurators, board members | Medium – part of it is publicly available |
| Customer data | Customer databases, contracts, contacts | High – trade secret + personal data |
| Supplier data | Contracts, contacts of suppliers who are natural persons | Medium |
| Legal disputes | Data on parties to proceedings, complaints before the Commission for Personal Data Protection (CPDP) | High – may contain sensitive information |
| GDPR documentation | ROPA, DPA, DPIA, data breach records | Low – contains no data subjects’ data |
Data room – a GDPR-compliant approach
Only staged disclosure in the virtual data room is compatible with the principle of data minimisation (Art. 5(1)(c) GDPR). Disclosure must be proportionate to the stage of the deal:
Staged disclosure by phase
Stage 1: Early phase (preliminary interest)
What to disclose:
- Aggregated/anonymised data: number of employees, breakdown by department, average salaries by position
- Financial indicators without personal data
- Structural information on GDPR compliance (whether there is a DPO, a ROPA, the number of processors)
DO NOT disclose: names, EGN (Personal Identification Numbers), individual salaries, customer lists
Stage 2: Intermediate stage (after a Letter of Intent)
What to disclose:
- Pseudonymised data: positions and salaries without names
- Summarised customer data (number, sector, turnover without names)
- Legal disputes (anonymised)
- DPAs and contracts (with personal data redacted)
Requirements: NDA signed by the buyer
Stage 3: Final stage (before closing)
What may be disclosed:
- Individual data of key persons (managers, senior management)
- Limited access to customer contracts (with NDA + DPA)
- Full GDPR documentation for risk assessment
Requirements: NDA + DPA with the virtual data room provider + justification for each access
Critical: An NDA (non-disclosure agreement) is not a sufficient substitute for a DPA. If the virtual data room is provided by a third party (Intralinks, Datasite, Ansarada, etc.), that party is a processor of personal data and must have a DPA under Art. 28 GDPR. An NDA and a DPA serve different functions – both documents are required.
Legal basis for sharing in due diligence
The seller who discloses personal data in a virtual data room must have a legal basis for this sharing:
| Legal basis | Applicability in M&A | Notes |
|---|---|---|
| Legitimate interest (Art. 6(1)(f)) | The main basis for the due diligence phase | The seller has a legitimate interest in selling its business, and the buyer – in assessing the risks |
| Contract (Art. 6(1)(b)) | After signing the SPA – for the performance of the contract | Only if the processing is objectively necessary for performance |
| Legal obligation (Art. 6(1)(c)) | Specific regulatory requirements | E.g. notification of the Commission for Protection of Competition (CPC) of a concentration |
| Consent (Art. 6(1)(a)) | NOT recommended | Impractical – impossible to obtain from thousands of customers and employees |
LIA in due diligence
When relying on legitimate interest, a legitimate interest assessment (LIA) is required. The three-part test is applied as follows:
- Legitimate interest: The seller has a legitimate interest in selling its business. The buyer has an interest in carrying out a thorough review before the deal. The CJEU has confirmed that commercial interests are legitimate.
- Necessity: Sharing certain data is objectively necessary to assess the value and the risks. The staged approach ensures minimisation.
- Balancing: The interests of the data subjects (employees, customers) are protected by an NDA, a limited circle of recipients with access, staged disclosure and anonymisation or pseudonymisation in the early phases.
Recital 48 GDPR: The transmission of personal data within a group of undertakings for internal administrative purposes is recognised as a legitimate interest. This also applies in M&A once the deal has reached a sufficiently mature phase.
Planning an M&A deal? Ensure GDPR compliance
- GDPR due diligence of the target company
- Structuring the virtual data room in compliance with GDPR
- LIA for sharing data in due diligence
- Post-integration GDPR plan
Phase 2: Deal execution (signing → closing)
Between the signing of the share purchase agreement (SPA) and closing, additional GDPR obligations arise:
Informing data subjects
When the controller changes (from seller to buyer), notification under Art. 14 GDPR is required:
- Employees: Inform them that their data will be transferred to the new owner. Where the employer changes under Art. 123 of the Labour Code (transfer of an undertaking or part of it), employment relationships transfer automatically, but the information obligations under GDPR remain.
- Customers: Notify them of the change of controller. Update the privacy notice.
- Suppliers and counterparties: Inform them of the new controlling entity.
Timing: Notifying employees before closing may create business risks (staff turnover, competitive actions). GDPR, however, requires the information to be provided “within a reasonable period” after the new controller obtains the data – usually within 1 month (Art. 14(3)(a)). Carefully assess the timing according to the specific business risks and the statutory deadlines.
Review of DPAs
If the target company has DPAs with processors (accountants, IT providers, cloud services), these contracts must be reviewed and potentially renegotiated after the change of ownership.
Phase 3: Post-integration
After the deal is completed, the most complex GDPR phase begins – the integration of two (or more) organisations with potentially different GDPR practices:
Key post-integration tasks
| Task | What it involves | Deadline |
|---|---|---|
| Updating the privacy notice | New controller, new purposes, new recipients | Within 1 month after closing |
| Merging databases | Migration of customer and HR data; verification of the legal bases | 3-6 months |
| Review of the ROPA | Merging the records; new processing activities | Within 3 months |
| Review and renegotiation of DPAs | All DPAs with processors must reflect the new controller | Within 3 months |
| Harmonising the retention policy | Aligning the retention periods | 3-6 months |
| Review of consents | Checking whether existing consents cover the new purposes | Within 3 months |
| DPO appointment | Whether the combined organisation needs a data protection officer (DPO) | Immediately |
Merging customer databases
One of the most sensitive stages of post-integration is the merging of customer databases. If both companies have customers for whom different legal bases are relied on (e.g. consent in one and legitimate interest in the other), you must carefully assess:
- Whether the legal bases remain valid after the change of controller
- Whether the consents cover processing by a new controller (usually – they do not)
- Whether there is a need for new consent or another basis
- Whether the merged database creates new risks (profiling, a larger volume of data)
Marketing after M&A: If the acquired company had consent-based marketing lists, the new owner cannot automatically use them. Consent was given to a specific controller for specific purposes. Either new consent or another legal basis is required.
Inherited GDPR liability
One of the most serious risks in M&A is inheriting GDPR liability for infringements committed before the deal.
Case: Marriott / Starwood (2020)
Facts: Marriott acquired Starwood Hotels in 2016. In 2018 it was discovered that hackers had had access to the Starwood database since 2014, affecting 339 million records.
Outcome: The ICO imposed a fine of GBP 18.4 million on Marriott – even though the breach began before the acquisition.
Takeaway: GDPR due diligence is critically important – the buyer must establish whether the target company has known or potential infringements before closing.
GDPR due diligence checklist
When assessing the target company, include the following GDPR checks:
Red flags
- No ROPA
- No DPAs with processors (accountant, hosting, SaaS)
- Unresolved complaints or proceedings before the CPDP
- No data protection officer (DPO) where one is mandatory
- International transfers without a lawful mechanism (DPF, SCCs)
- History of data breaches without proper notification
- No documented legal bases for the processing
- No privacy notice or an outdated one
- Marketing lists without proof of consent
- Data retained beyond the statutory periods
Green signals
- An up-to-date ROPA covering all processing activities
- DPAs with all processors, including cloud services
- An appointed DPO (where required)
- Documented legal bases for each processing operation
- An up-to-date privacy notice, available online
- A data breach notification procedure
- A clean record before the CPDP (no fines or unresolved complaints)
- DPIAs for high-risk processing
- GDPR training for staff
How GDPR risks affect the price
GDPR risks are increasingly reflected in the pricing of M&A deals:
- Cost of bringing GDPR into compliance: The costs of achieving compliance after the deal (ROPA, DPAs, privacy notice, training) can be significant and must be factored in
- Potential fines: If due diligence reveals past infringements, the potential fine must be reflected in the price or covered by warranty and indemnity clauses in the SPA
- Value of customer data: If customer data is the main reason for the acquisition (e.g. a marketing database) but was collected without a valid legal basis – its value to the buyer is practically zero
GDPR due diligence for your M&A deal
- Full GDPR assessment of the target company
- Structuring the virtual data room in line with GDPR
- GDPR warranty and indemnity clauses in the SPA
- Post-integration GDPR compliance plan
The most common mistakes in M&A and GDPR
- Disclosing individual employee data in an early phase of due diligence
- No DPA with the virtual data room provider
- Assuming that an NDA is sufficient (NDA ≠ DPA)
- Not carrying out GDPR due diligence (only financial and legal)
- Failing to notify employees after closing
- Merging databases without verifying the legal bases
- Automatically using the acquired company’s marketing lists
- No GDPR warranty and indemnity clauses in the SPA
- Neglecting intra-group transfers after integration
- Staged disclosure: anonymised → pseudonymised → individual
- DPA with the virtual data room provider (Intralinks, Datasite, etc.)
- LIA for sharing data in due diligence
- GDPR due diligence checklist as a standard part of the process
- Notifying data subjects within a reasonable period after closing
- Post-integration GDPR plan with specific deadlines
- GDPR representations and indemnities in the SPA
Practical timeline
| Period | Action | Responsible party |
|---|---|---|
| Before the LoI | Anonymised data in the virtual data room; NDA | Seller + M&A adviser |
| After the LoI | Pseudonymised data; LIA; DPA with the virtual data room provider | Seller + GDPR consultant |
| Before signing | GDPR due diligence of the target company; GDPR clauses in the SPA | Buyer + lawyer |
| Signing → Closing | Preparing notifications; review of DPAs | Both parties |
| 0-1 month after closing | Notifying data subjects (Art. 14); updating the privacy notice | Buyer (new controller) |
| 1-3 months after closing | Merging the ROPAs; renegotiating DPAs | Buyer + DPO |
| 3-6 months after closing | Database migration; harmonising the retention policy | Buyer + IT + DPO |
Frequently asked questions
What legal basis is used for sharing data in due diligence?
The main legal basis is legitimate interest (Art. 6(1)(f) GDPR). The seller has a legitimate interest in selling the business, the buyer – in assessing the risks. A documented LIA is required, taking into account staged disclosure and the safeguards (NDA, limited access, anonymisation).
How do I organise a virtual data room in compliance with GDPR?
Apply staged disclosure: early phase – only aggregated/anonymised data; intermediate phase – pseudonymised (without names); final – individual data only for key persons. Conclude a DPA with the virtual data room provider. Limit access to the minimum necessary circle of persons. Document every access.
Do I inherit GDPR fines when acquiring a company?
Yes. When shares are acquired, the legal entity remains the same and the new owner inherits all obligations, including GDPR liability. The Marriott/Starwood case showed that the buyer can be fined for infringements that began before the acquisition. That is why GDPR due diligence is essential.
When must I inform the target company’s employees?
Under Art. 14(3)(a) GDPR – “within a reasonable period” after obtaining the data, but no later than 1 month. In practice, notification usually takes place immediately after closing so as not to compromise the confidentiality of the deal. The notice must contain all the elements under Art. 14.
Is a DPA needed with the virtual data room provider?
Yes, it is mandatory. The virtual data room provider (Intralinks, Datasite, Ansarada, etc.) is a processor of personal data under Art. 28 GDPR. A DPA with all the mandatory elements is required. Most providers offer a ready-made DPA – check whether it covers Art. 28(3). See the article on DPAs with cloud providers.
How should I process the acquired company’s customer data after the deal?
Check on what legal basis the data was collected. If it is consent – new consent is probably needed, because consent was given to a specific controller. If it is a contract or legitimate interest – the basis may remain valid, but update the privacy notice. Never merge databases without a prior GDPR analysis.
What is GDPR due diligence and what should I check?
GDPR due diligence is an assessment of the target company’s GDPR compliance. Check: whether there is a ROPA, DPAs with processors, a privacy notice, a DPO, DPIAs for high-risk processing, the history of breaches and complaints, international transfers, the retention policy and documented legal bases. Every gap is a potential financial risk.
Can a GDPR infringement reduce the price of an M&A deal?
Yes, and this is an increasingly common practice. Potential GDPR fines, the costs of bringing processing into compliance and the risk of inherited liability are factored into the price. In the case of serious infringements (no ROPA, unlawful transfers, unresolved complaints), buyers usually ask for a price reduction or special indemnity clauses.
Comprehensive GDPR service for M&A deals
- GDPR due diligence of the target company
- Structuring a GDPR-compliant virtual data room
- Drafting GDPR representations and warranties for the SPA
- Post-integration GDPR plan with a timeline
- Training for the integration team
