How do data-privacy laws (DPDP / GDPR) affect M&A diligence and data transfer in a deal?

Your company is acquiring an Indian startup with a customer database of two million users.

Your European parent company operates under GDPR M&A data transfer protocols.

Your target company claims full compliance with India's DPDP in M&A requirements.

But during final diligence, your legal team discovers consent records are incomplete, data localization obligations were ignored, cross-border data flows lack legal basis, and employee databases contain sensitive personal information without documented processing grounds.

The deal is now delayed. Regulatory exposure is uncertain. Liability allocation becomes contentious. Integration planning stalls. Valuation adjustments are demanded. Transaction costs increase.

Welcome to the reality of data privacy due diligence M&A in 2025.

Businesses acquiring Indian companies, investing in Indian operations, or merging with Indian entities face a challenge that barely existed a decade ago: ensuring privacy compliance does not merely satisfy operational expectations, but determines whether the transaction can legally close, how liabilities will transfer, what indemnities must be negotiated, and whether post-closing penalties will arise.

India's Digital Personal Data Protection Act, 2023 (DPDP Act) has introduced enterprise accountability, consent requirements, data fiduciary obligations, cross-border transfer restrictions, and penalty provisions that directly affect mergers, acquisitions, business transfers, restructuring, and investment transactions involving Indian operations.

Globally, the European Union's General Data Protection Regulation (GDPR) remains the benchmark for cross-border GDPR M&A data transfer compliance, imposing obligations on businesses transferring personal data outside the European Economic Area (EEA) or acquiring entities that process EU citizen data.

Multinational acquirers, private equity investors, global legal departments, and cross-border enterprises must now integrate data privacy due diligence M&A into transaction planning as rigorously as financial audits, intellectual property reviews, regulatory compliance assessments, and litigation risk analysis.

This article explains how DPDP in M&A and GDPR M&A data transfer frameworks affect transaction structuring, what privacy red flags indicate non-compliance or hidden liabilities, how consent on business transfer obligations operate under Indian and European law, and what practical steps acquirers, investors, and legal teams must take to protect deal certainty, minimize regulatory exposure, and ensure lawful data integration post-closing.

Why Data Privacy Now Drives M&A Legal Risk in India

Until recently, most M&A transactions in India focused primarily on commercial contracts, financial statements, intellectual property ownership, regulatory licenses, litigation exposure, tax compliance, and employee obligations.

Data privacy due diligence M&A was often treated as a secondary compliance checkbox, rarely integrated into transaction valuation, negotiation strategy, or post-closing liability allocation.

That operational reality has changed.

India's DPDP Act, notified in August 2023, establishes a structured legal framework governing how businesses collect, process, store, transfer, and retain personal data of Indian users.

The Act applies to:

• Data Fiduciaries: Entities determining the purpose and means of processing personal data
• Data Processors: Entities processing data on behalf of fiduciaries
• Significant Data Fiduciaries: Entities processing large volumes of personal data or engaging in high-risk processing activities

Key obligations under the DPDP Act include:

• Obtaining valid consent for data processing (Section 6)
• Ensuring purpose limitation and data minimization (Section 4)
• Maintaining security safeguards (Section 8)
• Enabling data principal rights including access, correction, erasure, and grievance redressal (Sections 12–14)
• Appointing Data Protection Officers where required
• Notifying data breaches to the Data Protection Board of India (Section 8)
• Complying with cross-border data transfer restrictions (Section 16)

Non-compliance attracts penalties up to ₹250 crores under Section 33 of the DPDP Act.

Businesses acquiring Indian companies, investing in Indian operations, or integrating Indian subsidiaries must conduct thorough data privacy due diligence M&A to identify:

• Whether valid consent exists for existing data processing
• Whether consent on business transfer requirements will be triggered
• Whether cross-border GDPR M&A data transfer mechanisms are legally compliant
• Whether privacy red flags indicate regulatory violations, hidden liabilities, or operational gaps
• Whether data processing agreements with vendors, service providers, or business partners are enforceable
• Whether employee databases, customer records, financial data, health information, or biometric data require additional safeguards
• Whether data localization obligations restrict post-closing integration

Failure to conduct proper DPDP in M&A diligence creates transaction risk affecting deal closure, valuation certainty, indemnity negotiations, regulatory approvals, and post-closing operational continuity.

Understanding the DPDP Act's Impact on Business Transfers in India

One of the most significant provisions affecting data privacy due diligence M&A under India's DPDP Act is the treatment of data during business transfers, mergers, acquisitions, and restructuring.

Consent on Business Transfer: Section 7(a) of the DPDP Act

Section 7(a) of the DPDP Act creates a narrow exemption allowing data fiduciaries to process personal data without fresh consent during business transfers under the following conditions:

• The transfer occurs as part of a merger, acquisition, amalgamation, or business restructuring
• The data processing remains consistent with the original purpose for which consent was obtained
• The acquiring entity continues using the data only for the purposes disclosed to data principals initially

This provision recognizes commercial necessity while maintaining user privacy expectations.

However, businesses cannot assume automatic consent on business transfer protection.

Key Compliance Risks in M&A Transactions

Several privacy red flags may arise during DPDP in M&A transactions:

1. Invalid or Missing Consent Records

If the target company collected personal data without obtaining valid, informed, specific, and unambiguous consent, the acquiring entity inherits compliance liability.

Consent must satisfy requirements under Section 6 of the DPDP Act, including:

• Clear disclosure of data processing purposes
• Identification of data fiduciary
• Explanation of data principal rights
• Option to withdraw consent freely

Businesses operating legacy systems, pre-DPDP data collection models, or informal customer databases often lack documented consent mechanisms.

2. Purpose Limitation Violations

Even where initial consent exists, Section 7(a) requires that post-acquisition processing remain consistent with original purposes.

If the acquiring company plans to:

• Use customer data for new marketing campaigns
• Combine datasets for analytics purposes not originally disclosed
• Share data with group companies or international affiliates
• Deploy AI-driven profiling tools
• Cross-sell products or services beyond the original scope

Fresh consent may be required, affecting integration timelines, operational planning, and revenue projections.

3. Cross-Border Data Transfer Exposure

Section 16 of the DPDP Act empowers the Central Government to restrict cross-border transfers of personal data to specified countries or jurisdictions.

Multinational acquirers planning to:

• Migrate Indian customer databases to global cloud infrastructure
• Centralize data processing in offshore locations
• Share employee data with international HR platforms
• Integrate Indian operations into global ERP systems

must ensure lawful transfer mechanisms exist or risk regulatory enforcement, operational disruption, and transaction liability.

4. Significant Data Fiduciary Obligations

The DPDP Act allows the government to designate certain entities as Significant Data Fiduciaries based on volume, sensitivity, or nature of data processing.

Such entities face enhanced obligations including:

• Appointing Data Protection Officers
• Conducting Data Protection Impact Assessments (DPIAs)
• Implementing additional security measures
• Undertaking periodic audits

Acquirers must assess whether the target company qualifies as a Significant Data Fiduciary and whether compliance systems are operational.

5. Vendor and Processor Contracts

Many Indian businesses rely on third-party vendors, cloud service providers, payment processors, or marketing platforms to handle personal data.

Section 8(5) of the DPDP Act requires data fiduciaries to ensure that processors comply with DPDP obligations through enforceable contracts.

Data privacy due diligence M&A must verify:

• Whether valid data processing agreements exist
• Whether processors meet security and confidentiality standards
• Whether liability allocation clauses protect the acquiring entity
• Whether processors operate within jurisdictions permissible under Indian law

6. Data Breach History

Section 8(8) of the DPDP Act mandates data fiduciaries to notify the Data Protection Board of India upon occurrence of a personal data breach.

Undisclosed breaches, unreported incidents, inadequate breach response protocols, or ongoing security vulnerabilities constitute serious privacy red flags affecting transaction valuation, indemnity negotiations, and regulatory exposure.

How GDPR Affects Cross-Border M&A Transactions Involving India

Multinational businesses acquiring Indian companies that process European customer data, operate European subsidiaries, or serve EU-based users must simultaneously comply with GDPR M&A data transfer requirements.

GDPR's Jurisdictional Reach

The GDPR applies to:

• Controllers and processors established in the EU
• Controllers and processors outside the EU offering goods or services to EU data subjects
• Controllers and processors outside the EU monitoring behavior of EU data subjects

Indian companies falling within these categories must comply with GDPR obligations including:

• Lawful basis for processing (Article 6)
• Enhanced consent requirements for sensitive data (Article 9)
• Data subject rights including access, rectification, erasure, restriction, portability, and objection (Articles 15–21)
• Privacy by design and default (Article 25)
• Data protection impact assessments for high-risk processing (Article 35)
• Appointment of Data Protection Officers where required (Article 37)
• Notification of data breaches to supervisory authorities within 72 hours (Article 33)

Non-compliance can result in administrative fines up to €20 million or 4% of global annual turnover, whichever is higher, under Article 83 of the GDPR.

Cross-Border Data Transfer Mechanisms Under GDPR

Transferring personal data from the EU to India requires a lawful GDPR M&A data transfer mechanism, as India is not recognized as a jurisdiction ensuring an adequate level of data protection under Article 45 of the GDPR.

Businesses must rely on:

1. Standard Contractual Clauses (SCCs)

The European Commission has approved Standard Contractual Clauses under Article 46(2)(c) as a legal instrument for cross-border data transfers.

Acquirers must:

• Execute SCCs between EU data exporters and Indian data importers
• Conduct Transfer Impact Assessments (TIAs) evaluating Indian legal framework, government access risks, and enforcement mechanisms
• Implement supplementary measures where necessary to ensure GDPR-equivalent protection

2. Binding Corporate Rules (BCRs)

Article 47 permits multinational groups to adopt Binding Corporate Rules allowing intra-group data transfers.

BCRs require approval from EU supervisory authorities and impose enforceable data protection obligations across group entities.

3. Specific Derogations (Article 49)

In limited circumstances, data transfers may occur based on:

• Explicit consent of data subjects
• Necessity for contract performance
• Important public interest grounds
• Legal claims

However, Article 49 derogations are narrowly construed and cannot serve as the primary legal basis for ongoing GDPR M&A data transfer operations.

Due Diligence Priorities for GDPR Compliance in M&A

Acquirers must assess:

• Whether the target company processes EU personal data
• What lawful basis exists for processing
• Whether valid SCCs or BCRs are in place for cross-border transfers
• Whether Transfer Impact Assessments have been conducted
• Whether Data Protection Officers have been appointed
• Whether data subject rights mechanisms are functional
• Whether data breach notification procedures comply with Article 33
• Whether vendor contracts include GDPR-compliant processor clauses
• Whether historical GDPR violations, regulatory investigations, or supervisory authority notices exist

Failure to identify privacy red flags related to GDPR M&A data transfer obligations exposes acquirers to regulatory enforcement, litigation risk, operational disruption, and reputational damage across European markets.

Key Privacy Red Flags in M&A Due Diligence

Conducting thorough data privacy due diligence M&A requires identifying privacy red flags indicating non-compliance, operational gaps, or hidden liabilities.

Common Privacy Red Flags Include:

1. Absence of Privacy Policies or Notices

Lack of publicly available, accessible, and transparent privacy notices violates both DPDP Act and GDPR requirements.

2. No Documented Consent Mechanisms

Inability to demonstrate valid, informed, and specific consent for data collection and processing.

3. Inadequate Data Inventory

Failure to maintain records of personal data categories, processing purposes, data sources, retention periods, and disclosure practices.

4. Weak Security Safeguards

Absence of encryption, access controls, incident response plans, or regular security audits.

5. Unmanaged Third-Party Processors

Lack of enforceable data processing agreements with vendors, cloud providers, or service partners.

6. Cross-Border Data Flows Without Legal Basis

Transferring personal data internationally without SCCs, BCRs, or other lawful mechanisms.

7. Unresolved Data Breach Incidents

Historical breaches not reported to authorities, inadequate breach response, or ongoing security vulnerabilities.

8. Non-Responsive Data Subject Rights Mechanisms

Failure to implement processes enabling data principals to exercise access, correction, erasure, or grievance rights.

9. Non-Compliance with Data Localization Requirements

Storing or processing regulated data categories outside India where localization mandates apply (e.g., payment data under RBI regulations).

10. Regulatory Notices or Investigations

Pending inquiries, enforcement actions, or notices from the Data Protection Board of India, European Data Protection Authorities, or other regulators.

Identifying these privacy red flags early allows acquirers to:

• Negotiate indemnities and liability caps
• Demand escrow arrangements or holdback provisions
• Require pre-closing remediation
• Adjust purchase price
• Structure acquisition terms minimizing regulatory exposure

Practical Steps for Data Privacy Due Diligence in M&A Transactions

Acquirers, investors, and legal teams must integrate data privacy due diligence M&A systematically into transaction workflows.

Phase 1: Pre-Transaction Assessment

Action Steps:

• Request target company's privacy policies, consent forms, data processing records, and data mapping documentation
• Identify categories of personal data processed (customer, employee, vendor, financial, health, biometric, children's data)
• Determine whether target qualifies as a Significant Data Fiduciary under DPDP Act
• Assess whether GDPR applies based on EU customer base, subsidiaries, or monitoring activities
• Review existing data processing agreements with third-party vendors, cloud providers, and service partners

Phase 2: Legal and Regulatory Compliance Review

Action Steps:

• Verify compliance with DPDP Act obligations including consent, purpose limitation, security safeguards, and data principal rights
• Confirm existence of lawful GDPR M&A data transfer mechanisms (SCCs, BCRs, or derogations) where applicable
• Review data breach notification history and incident response protocols
• Assess pending regulatory investigations, enforcement actions, or supervisory authority notices
• Evaluate vendor contracts for indemnity clauses, liability allocation, and processor compliance obligations

Phase 3: Operational Risk Assessment

Action Steps:

• Identify privacy red flags including missing consent, inadequate security, unmanaged processors, or cross-border transfer violations
• Assess impact of consent on business transfer requirements on post-closing integration plans
• Evaluate data localization obligations affecting cloud infrastructure, data migration, or centralized processing
• Review IT infrastructure, access controls, encryption standards, and incident response capabilities
• Assess employee training, governance structures, and compliance accountability mechanisms

Phase 4: Transaction Structuring and Liability Allocation

Action Steps:

• Negotiate representations and warranties addressing DPDP and GDPR compliance
• Draft indemnity provisions protecting acquirer from pre-closing privacy violations, regulatory penalties, or data breach liabilities
• Structure escrow or holdback arrangements pending resolution of identified privacy red flags
• Require pre-closing remediation for material compliance gaps
• Include post-closing covenants obligating seller to cooperate in regulatory investigations or data subject complaints

Phase 5: Post-Closing Integration and Compliance

Action Steps:

• Implement lawful consent on business transfer mechanisms where required under Section 7(a) of DPDP Act
• Update privacy notices reflecting changes in data fiduciary, processing purposes, or data sharing practices
• Ensure valid GDPR M&A data transfer mechanisms remain in place post-acquisition
• Integrate target's data processing operations into acquirer's compliance systems
• Appoint Data Protection Officers, conduct Data Protection Impact Assessments, and implement enhanced security measures where applicable
• Train employees on DPDP and GDPR obligations
• Monitor regulatory developments and supervisory authority guidance affecting data privacy due diligence M&A practices

Common Problems Faced by Multinational Acquirers and Investors

Compliance with Multiple Jurisdictions

NRIs, foreign nationals, and multinational corporations acquiring Indian businesses face the challenge of ensuring compliance with both local Indian data privacy laws and international regulations such as GDPR.

The interplay between the DPDP Act and GDPR creates complex obligations:

• Indian operations must comply with consent, purpose limitation, and security requirements under DPDP Act
• EU-facing operations must simultaneously satisfy GDPR's lawful basis, data subject rights, and cross-border transfer requirements
• Conflicting or overlapping obligations require careful legal analysis and coordination

Unclear Data Policies and Documentation Gaps

Many target companies lack clear, comprehensive data management policies, creating significant due diligence challenges:

• Absence of written privacy policies or notices
• Inconsistent consent collection practices across business units or customer segments
• Incomplete or inaccurate data inventories
• Poorly documented vendor relationships and data processing arrangements
• Lack of retention schedules or deletion protocols

These gaps create uncertainty around regulatory compliance, liability exposure, and integration feasibility.

Valuation Impact and Deal Terms

Identified privacy red flags directly affect transaction economics:

• Purchase price adjustments reflecting compliance costs or remediation expenses
• Escrow or holdback provisions protecting acquirer from undisclosed liabilities
• Indemnity caps and survival periods negotiated to cover regulatory penalties or litigation damages
• Conditional closing requirements mandating pre-closing remediation of material compliance gaps

Acquirers must quantify privacy risks and incorporate them into financial modeling, deal structure, and negotiation strategy.

Post-Closing Integration Challenges

Even after closing, data privacy due diligence M&A considerations affect operational integration:

• Obtaining fresh consent where post-acquisition data uses exceed original purposes
• Migrating data to new systems, platforms, or jurisdictions while maintaining lawful transfer mechanisms
• Harmonizing privacy policies, consent forms, and data subject rights procedures across merged entities
• Training combined workforce on unified compliance standards
• Managing regulatory inquiries or data subject complaints arising from pre-closing practices

Successful integration requires advance planning, clear ownership of compliance obligations, and ongoing monitoring of regulatory developments.

Frequently Asked Questions

What are the key aspects of data privacy due diligence in M&A?

The key aspects include assessing the data inventory, reviewing consent practices, evaluating security measures, understanding regulatory requirements such as DPDP and GDPR, verifying cross-border transfer mechanisms, examining vendor contracts, investigating data breach history, and identifying operational gaps or compliance deficiencies.

How does the DPDP Act impact M&A transactions?

The DPDP Act mandates explicit consent for processing personal data, imposes security and transparency obligations, restricts cross-border data transfers, and creates potential liabilities for non-compliance. Section 7(a) provides limited consent on business transfer exemptions, but only where post-acquisition processing remains consistent with original purposes. Penalties up to ₹250 crores under Section 33 create significant transaction risk.

Why is GDPR important in cross-border M&A?

GDPR applies to data of EU residents, affecting how companies manage personal information across borders. Indian companies serving EU customers, operating EU subsidiaries, or monitoring EU data subjects must comply with GDPR obligations including lawful processing bases, enhanced consent requirements, data subject rights, privacy by design, breach notification, and cross-border transfer restrictions. Non-compliance can result in fines up to €20 million or 4% of global annual turnover.

What are some privacy red flags to watch for during M&A?

Privacy red flags include inconsistent or absent data policies, missing or invalid consent documentation, inadequate data inventories, weak security safeguards, unmanaged third-party processors, cross-border data flows without legal basis, unresolved data breach incidents, non-responsive data subject rights mechanisms, non-compliance with data localization requirements, and pending regulatory investigations or enforcement actions.

How can companies ensure compliance with DPDP during M&A?

Companies can ensure compliance by conducting thorough data privacy audits, verifying consent mechanisms satisfy Section 6 requirements, assessing Significant Data Fiduciary status and obligations, confirming data processing agreements with vendors meet Section 8(5) standards, evaluating cross-border transfer restrictions under Section 16, reviewing data breach notification protocols, and obtaining legal guidance tailored to their transaction structure and operational model.

What are the penalties for non-compliance with data privacy laws?

Penalties under the DPDP Act can reach up to ₹250 crores under Section 33. GDPR non-compliance can result in administrative fines up to €20 million or 4% of global annual turnover, whichever is higher, under Article 83. Additional consequences may include regulatory investigations, litigation damages, reputational harm, business disruption, and loss of customer trust.

When should companies seek professional legal help for M&A?

Companies should seek legal assistance as soon as they begin contemplating M&A transactions to ensure comprehensive data privacy due diligence M&A, proper risk assessment, effective transaction structuring, enforceable representations and warranties, appropriate indemnity provisions, compliant post-closing integration, and ongoing regulatory monitoring. Early engagement allows legal teams to identify privacy red flags, negotiate protective terms, and develop remediation strategies before closing.

Conclusion

Navigating data privacy due diligence M&A requires a comprehensive understanding of the implications of DPDP and GDPR, especially for cross-border transactions. The intersection of India's Digital Personal Data Protection Act, 2023 and the European Union's General Data Protection Regulation creates complex compliance obligations affecting transaction structuring, liability allocation, operational integration, and regulatory exposure.

Acquirers, investors, and legal teams must conduct systematic due diligence to identify privacy red flags, verify consent on business transfer compliance under Section 7(a) of the DPDP Act, confirm lawful GDPR M&A data transfer mechanisms, assess Significant Data Fiduciary obligations, evaluate vendor contracts, investigate data breach history, and plan for post-closing integration challenges.

Awareness and proactive management of data privacy risks can help businesses safeguard their interests, protect deal certainty, minimize regulatory penalties, and ensure lawful, compliant operations across jurisdictions.

For those engaging in legal matters related to data privacy due diligence M&A, consulting an experienced legal provider is essential for support in this complex landscape.

This article is for informational purposes only and does not constitute legal advice. Please consult a qualified legal professional for specific guidance.

About LawCrust

LawCrust Global Consulting Ltd. is the enterprise legal and consulting arm of the LawCrust Group, delivering lawyer-led corporate legal services, alternative legal services (ALSP), legal process outsourcing (LPO), legal operations support, and AI-enabled legal infrastructure for global businesses, multinational corporations, law firms, procurement-led enterprises, general counsels, investors, and institutional clients.

With operational headquarters in Mumbai's Bandra Kurla Complex (BKC) and a strategic US presence through LawCrust Inc., Delaware, we support cross-border legal and commercial operations involving India, the United States, the Middle East, and other international jurisdictions.

For expert legal assistance, Call Now: +91 8097842911 Email: inquiry@lawcrust.com