How The DPDP Act Impacts Mergers, Acquisitions And Due Diligence

For years, M&A due diligence followed a familiar script. Lawyers reviewed contracts and litigation, accountants examined financial records, and IT teams assessed systems, licences and cybersecurity. Data protection often remained a secondary consideration. That is changing with the introduction of India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the notification of the Digital Personal Data Protection Rules, 2025 (DPDP Rules).

While the substantive provisions of the DPDP Act are being brought into force in phases, the new framework is already influencing how businesses approach data governance and transaction planning. For M&A transactions, personal data is increasingly becoming an issue that can affect valuation, transaction structuring, risk allocation and post-closing integration.

Why Data Matters in M&A Transactions

Companies involved in acquisitions and mergers typically hold significant volumes of personal data relating to employees, customers, vendors, contractors and other individuals. Under the DPDP Act, individuals whose personal data is processed are Data Principals, while an entity that determines the purpose and means of processing may qualify as a Data Fiduciary.

During due diligence, a seller may need to provide the prospective acquirer with access to personal data. This makes the handling of such information an important data protection consideration rather than merely a commercial exercise.

Once the substantive provisions of the DPDP Act become applicable, transaction parties will need to assess the legal basis for processing and sharing personal data during due diligence, together with applicable notice, consent, security and other compliance requirements.

Consent Considerations During Due Diligence

The DPDP Act establishes requirements governing consent, including that consent should be free, specific, informed and capable of being withdrawn. This raises practical questions where personal data was originally collected for purposes unrelated to a potential corporate transaction.

For example, a buyer conducting due diligence on an e-commerce business may wish to examine detailed customer information to assess purchasing patterns, customer retention or revenue concentration. Where identifiable personal data is involved, the parties will need to consider whether the proposed processing is covered by the applicable legal basis and whether additional safeguards are required.

As a practical risk-management measure, transaction teams may therefore use anonymised or aggregated information during the early stages of due diligence and limit access to identifiable information to situations where it is genuinely necessary and an appropriate legal basis is available.

The Merger-Related Legitimate Use Ground and Its Limits

The DPDP Act contains a specific legitimate-use ground for processing personal data that is necessary for a scheme of compromise, arrangement, merger, amalgamation or demerger that has been approved or sanctioned by a court, tribunal or other competent authority.

This provision may be particularly relevant to transactions implemented through a court- or tribunal-approved scheme. However, it should not be treated as a general exemption for all M&A transactions.

For example, privately negotiated share acquisitions, slump sales and asset transfers may not fall within this specific legitimate-use ground merely because they result in a change of ownership or control. Transaction parties will therefore need to assess the other applicable legal bases and requirements rather than assuming that the merger-related provision applies.

Importantly, the substantive provisions containing these processing grounds are scheduled to take effect as part of the DPDP Act’s phased commencement, with the core provisions expected to become operational in May 2027.

Employee Data Adds Another Layer

M&A transactions frequently involve the transfer or review of employee information, including HR records, payroll information, attendance records, performance information and other employment-related data.

The DPDP framework does provide certain legitimate-use grounds relating to employment. However, these should not automatically be treated as a blanket basis for every form of employee-data processing associated with an acquisition.

Transaction parties should therefore assess the purpose of the proposed processing, the applicable legal basis, notice requirements and appropriate safeguards. Employee privacy considerations should also be incorporated into the integration plan rather than addressed only after completion of the transaction.

Cross-Border Transactions Require Additional Review

Cross-border M&A transactions can introduce further complexity where personal data is stored, accessed or processed outside India.

Section 16 of the DPDP Act adopts a comparatively liberal approach to international transfers, permitting transfers outside India unless the Central Government restricts transfers to a notified country or territory. However, the provision is itself subject to the Act’s phased commencement.

Foreign acquirers should therefore examine where the target’s personal data is stored and processed, whether overseas vendors or affiliates have access to the data, and whether sector-specific localisation requirements apply. Data mapping and vendor diligence can help identify potential restrictions before the transaction closes.

What This Means for Deal Risk

The financial consequences of data protection failures can be significant. The Schedule to the DPDP Act provides for penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches, among other potential penalties.

Although the substantive provisions are being phased in, this level of potential exposure makes data protection an increasingly relevant consideration in transaction risk assessment. Buyers may need to consider data protection findings when evaluating representations and warranties, indemnities, conditions precedent, remediation obligations and post-closing integration requirements.

In practice, data protection diligence is increasingly becoming a distinct workstream alongside financial, legal, tax and IT diligence. Deal teams may review privacy notices, consent practices, vendor arrangements, data-sharing arrangements, security controls, breach history, grievance mechanisms and, where applicable, Data Protection Officer arrangements.

Preparing for the New M&A Compliance Landscape

The phased implementation of the DPDP framework gives businesses time to identify and address potential gaps before the substantive provisions become operational. Acquirers and sellers should use this period to improve data inventories, document processing activities, review contractual arrangements and assess how personal data is handled throughout the transaction lifecycle.

The key lesson for M&A teams is straightforward: personal data should be treated much like financial statements, material contracts and pending litigation—a matter to be assessed carefully before signing, rather than a risk discovered only after the transaction has closed.

As India’s DPDP framework moves towards full implementation, businesses that incorporate data protection into the earliest stages of transaction planning will be better positioned to manage regulatory risk, negotiate appropriate protections and integrate acquired businesses without inheriting avoidable data governance problems.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.