Customer data, employee records, software platforms and commercial databases can represent significant value in an acquisition. They can also carry legal and operational liabilities that are not immediately visible from financial statements.
Data privacy due diligence examines whether the target handles personal information lawfully, what breaches or complaints may exist, and how those risks should be reflected in price, transaction protections and integration planning. O’Reilly Law combines corporate transaction experience with data protection advice.
The ability to disclose or transfer a customer database depends on the information, purpose, transaction structure and applicable lawful-processing requirements. Share sales and asset disposals can raise different questions, particularly where data is moved to another responsible party.
We help clients address identified risks through disclosures, warranties, indemnities, appropriate conditions and remediation commitments. Privacy diligence should inform negotiations and closing plans, not end as an isolated checklist.
We coordinate with deal teams and, where needed, specialist cybersecurity advisers. The depth of review is calibrated to transaction value, available information and the nature of the target business.
Not automatically. The answer depends on what information is involved, the lawful processing grounds, prior notices, purposes and transaction structure.
Yes. A share sale often leaves the same legal entity holding the information, whereas an asset sale may involve a transfer to another entity. Both can create compliance and integration issues.
Undisclosed security incidents, missing supplier contracts, unlawful collection or reuse of data, inadequate notices and unexplained international transfers are examples.
Privacy and security warranties may be appropriate, together with disclosure and remedies tailored to the transaction. Material findings should influence the drafting.
Ideally during the main legal due diligence process, with sufficient time to evaluate findings and incorporate them into transaction terms before signing or closing.
We help buyers, sellers and investors identify material privacy risks and translate them into practical transaction protections.
Explore: Mergers & Acquisitions · POPIA Compliance
This page is general information and not legal advice.
Please complete the following form to get in touch with us.
"*" indicates required fields
