3.1 Data Protection Assessment
Data protection due diligence has become critical in M&A transactions, particularly with DPDPA 2023 enforcement. Undisclosed data protection liabilities can significantly impact deal value and post-acquisition risk.
Data Inventory and Mapping
The foundation of data protection assessment is understanding what data the target processes:
- Data Categories: Personal data, sensitive personal data, children's data, financial data, health data
- Data Subjects: Customers, employees, vendors, prospects, website visitors
- Data Volumes: Number of records, growth rate, retention periods
- Data Flows: Collection points, processing activities, sharing with third parties, cross-border transfers
- Data Storage: On-premises, cloud, third-party processors, backup locations
Key Questions:
- Is the target a Data Fiduciary or Data Processor?
- Has the target been designated as a Significant Data Fiduciary?
- Are consent mechanisms DPDPA-compliant?
- Has a Data Protection Officer been appointed (if required)?
- Are cross-border transfer mechanisms in place?
Compliance Status Assessment
| Assessment Area | Key Documents to Review | Red Flags |
|---|---|---|
| Privacy Notices | Website privacy policy, app disclosures, consent forms | Generic policies, missing DPDPA elements |
| Consent Records | Consent management systems, opt-in records | No records, unclear consent basis |
| Data Subject Rights | DSR procedures, response logs | No documented process, delayed responses |
| Vendor Contracts | DPAs with processors, subprocessor lists | Missing DPAs, unknown subprocessors |
| Breach History | Incident logs, CERT-In reports, regulatory correspondence | Undisclosed breaches, repeat incidents |
Historical Liability Assessment
- Past Breaches: Review all historical data breaches, their scope, and remediation status
- Regulatory Actions: Any ongoing or concluded investigations by regulators
- Litigation: Pending or threatened privacy-related claims
- Complaints: Data subject complaints and their resolution
- Audit Findings: Internal and external audit reports on data protection
Under successor liability principles, the acquiring company may inherit data protection liabilities. DPDPA penalties up to Rs. 250 crores and class action risks make thorough data protection due diligence essential. Always include specific data protection indemnities in the transaction documents.
3.2 Technology Asset Evaluation
Technology assets form a significant portion of enterprise value in many acquisitions. Understanding the security posture, licensing status, and technical debt is crucial for accurate valuation.
Security Posture Assessment
- Security Architecture: Network segmentation, access controls, encryption standards
- Vulnerability Management: Patching cadence, known vulnerabilities, penetration test results
- Incident History: Security incidents, breaches, near-misses over the past 3-5 years
- Security Controls: Endpoint protection, SIEM, DLP, identity management
- Third-Party Risk: Vendor security assessments, supply chain security
IP and Licensing Review
| Asset Category | Due Diligence Focus | Risk Considerations |
|---|---|---|
| Software Licenses | License compliance, transfer restrictions, audit clauses | License true-up costs, transfer fees |
| Open Source | OSS inventory, license types (GPL, MIT, Apache) | Copyleft obligations, attribution requirements |
| Custom Software | Ownership, development agreements, escrow | Third-party IP claims, contractor IP |
| Cloud Services | Service agreements, data portability, lock-in | Transition costs, service continuity |
| Patents/Trade Secrets | Registration status, validity, licensing | Infringement claims, expiration dates |
Infrastructure Assessment
- Data Center: Owned vs. leased, capacity, redundancy, disaster recovery
- Cloud Footprint: Multi-cloud strategy, egress costs, data residency
- Network Architecture: Bandwidth, latency, security controls
- Integration Complexity: APIs, middleware, data formats, migration effort
Request the target's most recent vulnerability assessment and penetration test reports. If these are more than 12 months old or don't exist, consider commissioning an independent security assessment as part of due diligence, with appropriate confidentiality protections.
3.3 Regulatory Compliance Review
Regulatory compliance due diligence must cover both current compliance status and emerging regulatory requirements that could affect the combined entity post-acquisition.
Key Regulatory Frameworks
1. Digital Personal Data Protection Act, 2023
- Data Fiduciary/Processor classification and obligations
- Significant Data Fiduciary status and additional requirements
- Cross-border transfer compliance
- Consent management and data principal rights
2. Sectoral Regulations
- Banking (RBI): Outsourcing guidelines, data localization, cyber security framework
- Insurance (IRDAI): Information security guidelines, cloud computing guidelines
- Telecom (TRAI/DoT): Data privacy regulations, security standards
- Healthcare: Electronic health records guidelines, telemedicine regulations
3. CERT-In Compliance
- 6-hour incident reporting capability
- 180-day log retention requirements
- Designated point of contact
- Clock synchronization with NTP
Review the target's regulatory horizon: Draft regulations, proposed amendments, and regulatory guidance that could affect compliance obligations post-closing. Build compliance costs into valuation models and budget for remediation.
Compliance Documentation Checklist
| Document | Purpose | Review Priority |
|---|---|---|
| Regulatory Licenses | Verify operating authority | Critical |
| Compliance Certificates | ISO 27001, SOC 2, PCI-DSS status | High |
| Audit Reports | Regulatory and internal audit findings | Critical |
| Regulatory Correspondence | Notices, inquiries, enforcement actions | Critical |
| Remediation Plans | Outstanding compliance gaps | High |
| Training Records | Compliance training completion | Medium |
3.4 Representations and Warranties
Cyber-specific representations and warranties in transaction documents allocate risk between buyer and seller. Well-drafted provisions protect the buyer while providing appropriate disclosure mechanisms for the seller.
Core Cyber Representations
Data Protection Representations
- Compliance: Target complies with all applicable data protection laws including DPDPA
- Consents: All necessary consents have been obtained for data processing activities
- Privacy Policies: Published privacy policies are accurate and have been followed
- DSR Compliance: All data subject requests have been properly handled
- Cross-Border: All international data transfers have valid legal mechanisms
Security Representations
- Security Measures: Reasonable and appropriate security measures are in place
- No Breaches: No data breaches have occurred (or full disclosure of past breaches)
- No Vulnerabilities: No material known unpatched vulnerabilities exist
- Insurance: Adequate cyber insurance coverage is in place
- Vendor Security: Critical vendors meet security requirements
Avoid over-reliance on knowledge qualifiers ("to the seller's knowledge") for cyber representations. Require seller to conduct reasonable inquiry and include specific individuals in the knowledge group who have actual cyber/data responsibilities.
Warranty Limitations and Disclosure
- Materiality Thresholds: Define what constitutes "material" for cyber matters
- Knowledge Qualifiers: Carefully define knowledge group and inquiry obligations
- Disclosure Schedules: Detailed schedules for known issues, incidents, investigations
- Bring-Down Conditions: Reps accurate at signing and closing
- Survival Periods: Extended survival for cyber reps (typically 3-5 years)
"In cyber M&A due diligence, what you don't find is often more important than what you do find. The absence of security documentation, incident logs, or compliance records is itself a significant red flag." Cyber Due Diligence Best Practices, CyberLaw Academy
3.5 Indemnification and Risk Allocation
Cyber-specific indemnities protect against post-closing discovery of pre-closing issues. Proper structuring considers both identified risks and unknown liabilities.
Indemnification Structure
| Indemnity Type | Coverage | Typical Terms |
|---|---|---|
| General Cyber Indemnity | Breaches of cyber representations | Subject to basket, cap |
| Specific Indemnity | Known issues disclosed in schedules | Often uncapped or higher cap |
| Fundamental Rep Breach | Fraud, willful breach | Uncapped, extended survival |
| Regulatory Indemnity | Pre-closing regulatory violations | Specific carve-out from cap |
| Breach Notification Costs | Pre-closing breaches discovered post-closing | Specific indemnity |
Special Cyber Indemnity Considerations
- Latent Breach Coverage: Breaches that occurred pre-closing but are discovered post-closing
- Regulatory Investigation: Costs of defending investigations triggered by pre-closing conduct
- Third-Party Claims: Claims from data subjects or business partners
- Remediation Costs: Security improvements required due to undisclosed vulnerabilities
- Reputational Harm: Quantification methodology for brand damage
Alternative Risk Allocation Mechanisms
1. Purchase Price Adjustment
Reduce purchase price for known cyber deficiencies identified during due diligence
2. Escrow/Holdback
Portion of purchase price held to cover potential cyber claims post-closing
3. Representations and Warranties Insurance (RWI)
Increasingly available for cyber representations, though often with specific exclusions
4. Earn-Out Adjustment
Reduce earn-out payments if cyber issues materialize post-closing
For targets with significant data processing, negotiate a separate cyber escrow (typically 2-5% of purchase price) held for 18-24 months specifically to cover data breach and security-related claims that may emerge post-closing.
Key Takeaways
- Data protection due diligence must map all personal data flows and assess DPDPA compliance
- Technology asset evaluation covers security posture, licensing, and technical debt
- Regulatory compliance review spans DPDPA, sectoral regulations, and CERT-In requirements
- Cyber representations should avoid excessive knowledge qualifiers and have extended survival
- Consider specific cyber indemnities, escrows, and RWI for risk allocation
Knowledge Check
Part 3 Quiz: M&A Cyber Due Diligence
Test your understanding of cyber due diligence concepts.