Data protection in due diligence: personal data and the GDPR in a company acquisition

The data that a seller discloses in the data room regularly contains personal information: names of employees and customers, salaries, contracts and sometimes health or other sensitive data. Every processing of such data needs a legal basis under the GDPR. For disclosure within a transaction, practice usually relies on the legitimate interest under Art 6 GDPR.

The legitimate interest requires a balancing between the interest of the parties in the review and the interests of the data subjects. This balancing should be documented, so that it is provable in case of dispute. With particularly sensitive data the legitimate interest is often not sufficient; here an additional safeguard is needed.

It is important to clarify the legal basis before opening the data room. Whoever first discloses data and only later looks for the basis has already carried out the processing. How this question fits into the overall review is shown in the post on the due diligence checklist.

Even with a legal basis the principle of data minimisation applies. Only what the review actually requires should be disclosed. In practice this means redaction and pseudonymisation: names are removed, salaries aggregated, individual persons no longer made directly identifiable. In this way the economic substance of the information can be reviewed without unnecessarily disclosing the data subjects.

In addition the need-to-know principle applies: access is granted only to those who need the data for their task. For particularly sensitive information, such as competitive data or individual salaries, the clean team has proven its worth. Here a narrowly limited, often external circle sees the raw data and passes only aggregated results to the parties.

These measures protect not only the data subjects but also the parties themselves, for example against competition-law concerns in an exchange of sensitive competitive data. We explore the concept of due diligence on our focus page on due diligence.

At completion of the transaction the data protection question arises again. In an asset deal the data passes to the buyer along with the business; this transfer is a separate processing with its own legal basis and its own information duties. Employees and customers must be informed of the new controller as soon as the business passes over.

In a share deal, by contrast, the data remains with the company, because only the holder of the shares changes. A transmission to a new controller does not take place; the information duties depend on the specific situation. This distinction follows the general structure that the post on the warranty catalogue takes up for the contractual safeguard.

Existing processor arrangements must also be observed. If the company uses service providers, for instance for payroll or cloud, the corresponding contracts must be continued or newly concluded. Where IT and cloud process personal data, data protection interlocks with the IT contracts, as the post on IP and IT in due diligence shows.

Alongside the transaction itself, the data protection maturity of the target company is a review subject in its own right. Reviewed are the record of processing activities, the technical and organisational measures, the handling of data breaches and the fulfilment of data subject rights such as access and erasure. A company with incomplete compliance carries a latent risk.

Such findings affect the valuation and the warranties. Common are warranties on compliance with the GDPR, on the presence of the records of processing and on the absence of open data protection proceedings. Identified risks, for example an ongoing supervisory review, can be covered by a targeted indemnity.

In practice it is worth involving data protection early in the review, because it touches the disclosure, the closing and the valuation at the same time. An initial assessment of the overall risks is provided by our M&A transaction risk profile.