Data Room Diligence in a Cross-Border Acquisition
Your company is acquiring a fintech with 1.2 million users in the EU and Brazil. Diligence finds that consent records are stored as screenshots, about 60% of privacy notices are outdated, seven of 22 vendor contracts lack data processing terms, and the target's primary cloud region is in the United States. The target suffered a breach 14 months ago that was not notified to any regulator. The deal is scheduled to close in 45 days, and the synergy plan calls for merging the target's marketing list into your CRM within 30 days of close. The target's privacy lead left two months ago. Your board wants the deal but is concerned about successor liability and regulatory exposure.
1. What privacy governance and risk decisions should be made before closing?
Read the worked answer
Treat the diligence findings as deal risk, not integration cleanup. Before closing, quantify the exposure and decide which findings are conditions precedent, which are price adjustments or escrow items, and which are post-close remediation. The unnotified breach is the highest priority: obtain the facts, assess whether notification is still legally required, and involve counsel. Do not assume the passage of time eliminates the obligation.
Require representations and warranties about privacy compliance, with specific disclosure schedules. Consider a closing condition that the target appoints an accountable privacy lead or that your team has interim authority. Prohibit any transfer or merging of personal data before close; use a clean team for diligence and segregate the target's data after close until the legal basis and notices are verified. Assess the cross-border transfer mechanism for the US cloud region and whether the target's contracts support it.
Brief the board on successor liability: acquiring the entity generally means acquiring its liabilities. The board should approve a remediation budget and a 100-day plan, not just the purchase price.
Reasoning: the synergy plan creates pressure to integrate data quickly, but integration before remediation can multiply the violation. Governance decisions before close preserve options and create evidence of responsible oversight.
2. Can the marketing lists be merged within 30 days of close? What conditions would have to be met?
Read the worked answer
Do not merge by default. The target's consents may not cover use by the acquirer, may have been collected under different notices, and may not be validly recorded if the evidence is only screenshots. Merging lists changes the controller and the purpose context, which can exceed the original consent. In the EU and Brazil, the acquirer needs a valid legal basis for its own marketing, and existing consent does not automatically transfer.
Conditions for any merge: verify the consent records and their scope; update notices to identify the acquirer and the processing; run a re-permission campaign where the legal basis is consent; honor opt-outs and suppression lists across both entities; and segregate the lists until each population is verified. For any reliance on legitimate interest, conduct and document a balancing assessment and provide an easy opt-out. Do not use the target's data for the acquirer's unrelated products without a fresh basis.
If the records cannot be verified, treat the list as unusable for marketing until re-permissioned. That may be commercially painful, but it is more defensible than a mass merge.
Reasoning: the 30-day synergy target is a business deadline, not a legal basis. The acquisition changes the identity of the sender and often the purpose, so the original consent cannot simply be inherited.
3. Outline the privacy priorities for the first 100 days after close, with reasoning for the order.
Read the worked answer
Days 1-30: stabilize and contain. Appoint an interim accountable privacy lead with authority across both entities. Freeze data integration except for approved migration work. Complete a data map for the target, inventory vendors, and confirm the breach notification position. Put the seven missing vendor contracts on a remediation tracker with deadlines. Segregate marketing data and stop any collection that lacks a valid basis or notice.
Days 30-60: remediate the highest-risk gaps. Replace or amend vendor contracts, implement a consent record system that captures evidence rather than screenshots, update privacy notices, and assess cross-border transfer mechanisms. Prioritize user-facing notices and data subject request handling because those are visible to regulators and users.
Days 60-100: integrate with controls. Harmonize retention schedules, incident response, and vendor risk tiers. Train staff on the combined policies. Run a tabletop exercise and a deletion test. Report progress to the board with metrics on open high-risk findings, contract remediation, and request timeliness.
Reasoning: the order follows risk and reversibility. Containing data flows and fixing the breach position prevent new harm. Contract and notice remediation addresses existing exposure. Integration controls come last because premature integration can create new violations before the old ones are fixed.