Data privacy and cybersecurity have become among the most important categories of due diligence in modern M&A transactions, driven by the proliferation of state and international data protection laws, the increasing frequency and severity of data breaches, and the growing recognition by buyers that a target’s data handling practices can represent significant contingent liability. Business owners who process personal information — and virtually every business that interacts with customers, employees, or vendors does — should expect rigorous privacy and cybersecurity scrutiny in any sale process and should prepare for it well in advance.

The Privacy Compliance Landscape: GDPR and CCPA

The two privacy frameworks that receive the most attention in M&A due diligence are the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Both are comprehensive data protection frameworks that impose significant obligations on businesses that collect and process personal data.

GDPR applies to any organization that processes personal data of EU residents, regardless of where the organization is located. It requires a lawful basis for all data processing activities, mandates specific disclosures to data subjects (privacy notices), imposes data minimization and purpose limitation principles, requires data processing agreements with vendors who process personal data on the company’s behalf, mandates specific technical and organizational security measures, and requires notification to supervisory authorities within 72 hours of discovering a qualifying personal data breach. Violations can result in fines of up to 4 percent of global annual revenue or 20 million euros, whichever is higher.

The CCPA/CPRA gives California residents rights to know what personal information is collected about them, to delete their personal information, to opt out of the sale or sharing of their personal information, and to correct inaccurate information. It requires businesses to maintain a privacy policy that clearly describes their data practices and to honor consumer rights requests within specified timeframes. The CPRA created the California Privacy Protection Agency, which has the authority to conduct audits and impose fines for violations. Other states, including Virginia, Colorado, Connecticut, Texas, and many others, have enacted similar comprehensive privacy laws, creating a complex patchwork of compliance obligations.

What Buyers Examine in Privacy Due Diligence

Buyers’ privacy due diligence begins with a review of the target company’s privacy notices and terms of service to assess whether they accurately describe the company’s data collection and use practices. This review frequently reveals gaps — either the notices are outdated and do not accurately reflect current practices, or the practices are inconsistent with what the notices disclose. Either situation creates legal risk.

Buyers also review the company’s data inventory and data mapping — documentation that identifies what personal data the company collects, why it collects it, how it uses it, how long it retains it, and with whom it shares it. A complete data inventory is a foundational privacy compliance requirement but is surprisingly rare, particularly in smaller companies. Its absence signals to a buyer that the company has not taken a systematic approach to privacy compliance, which creates uncertainty about the scope of potential violations.

The review of vendor and data processor agreements is another critical component. GDPR and many U.S. state laws require that data processors (third parties who process personal data on behalf of the company) be subject to written data processing agreements that impose specific security and compliance obligations. Buyers will look at the company’s major vendor relationships — cloud computing providers, marketing platforms, HR systems, payment processors — and assess whether appropriate data processing agreements are in place.

Cybersecurity Posture Assessment

In addition to privacy compliance, buyers conduct cybersecurity due diligence to assess the security of the target company’s information systems and data assets. This assessment typically covers: the company’s information security policies and procedures (are there written policies governing data access, password management, incident response, and vulnerability management?), the company’s technical security controls (is the company using encryption, multi-factor authentication, endpoint protection, and network monitoring?), the company’s vulnerability management practices (does it conduct regular penetration testing and vulnerability scanning?), and the company’s incident response capabilities (does it have a documented incident response plan that has been tested?).

Buyers may engage specialized cybersecurity firms to conduct technical assessments of the target’s systems, including vulnerability scanning and in some cases penetration testing. These assessments can reveal open security vulnerabilities, unpatched software, misconfigured systems, or other technical weaknesses that represent either current security risks or potential future breach exposure.

Data Breach History and Disclosure Obligations

Any history of data breaches is a significant focus of privacy due diligence. Buyers will ask for a complete history of known security incidents, including any incidents that were determined not to rise to the level of requiring regulatory notification or customer notification under applicable breach notification laws. The analysis of historical incidents covers: what data was affected, how many individuals were impacted, what notifications were made (and whether the notifications were timely and complete), whether any regulatory investigations resulted from the incidents, and what remediation steps were taken to prevent recurrence.

A company that has had a significant data breach may face ongoing regulatory exposure, class action litigation, or reputational damage that affects its value. The terms of any regulatory settlements, consent decrees, or consent orders from data protection authorities must be disclosed and reviewed, because they may impose ongoing operational obligations on the company that the buyer will need to comply with after closing.

Regulatory Consent Requirements for Data Transfers

In some transactions, the transfer of personal data from the seller to the buyer as part of the acquisition itself requires specific legal authority. Under GDPR, for example, a business combination that involves the transfer of EU personal data to a new controller may require a lawful basis for that transfer — typically legitimate interests or, in some cases, specific consent from data subjects. In certain regulated industries, such as healthcare (where HIPAA applies to transfers of protected health information), specific regulatory requirements govern what data can be transferred and under what conditions.

Sellers should work with privacy counsel to analyze the data transfer implications of the transaction structure and to determine whether any regulatory notifications, consents, or approvals are required before personal data can be transferred to the buyer. Failing to satisfy these requirements can result in regulatory enforcement actions after closing.

Privacy and cybersecurity liability is allocated in purchase agreements through a combination of representations and warranties (the seller represents that it has complied with applicable privacy laws, that there have been no material breaches, and that its security practices meet applicable standards), specific indemnification provisions for pre-closing privacy violations, and RWI coverage for breaches of privacy representations. Sellers should ensure that their privacy compliance programs are genuinely robust before entering a sale process, both because compliance is legally required and because a well-documented, mature privacy program is a positive valuation signal in the current M&A market.