Privacy Due Diligence in M&A in India: DPDP Act Risks, Data Room Checklist and Deal Protections

Introduction

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a comprehensive framework for the processing of digital personal data. For businesses involved in mergers and acquisitions (M&A), its phased commencement has an important implication: privacy due diligence must assess both the legal obligations that apply to a target today and the changes it will need to implement as the remaining provisions take effect.

The DPDP Act received presidential assent in August 2023. In November 2025, the Central Government notified the commencement timeline for the Act and the Digital Personal Data Protection Rules, 2025. The framework is being implemented in phases, with certain institutional and administrative provisions already in force, further provisions scheduled after one year, and the principal obligations relating to notice, consent, data principal rights and penalties scheduled to commence eighteen months after the relevant Gazette publication. The principal compliance phase is calculated to commence in May 2027, with the exact date to be read against the applicable commencement notification.

Until the relevant repeal provision takes effect, Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) remain relevant to the handling of sensitive personal data or information. The applicable legal framework must therefore be assessed by reference to the nature of the data, the processing activity and the provisions in force at the relevant time.

For an acquirer, privacy due diligence has two distinct objectives: assessing the target’s existing legal and contractual exposure, and determining how far its data practices are from the requirements it will need to meet under the DPDP framework. This assessment should inform valuation, transaction documentation and post-closing integration. A data room that contains privacy policies but lacks the underlying records of consent, processing activities, vendor arrangements and security incidents may not provide a reliable picture of the target’s actual exposure.

What Should Acquirers Request in the Data Room?

Privacy due diligence should begin with an assessment of what personal data the target collects, why it collects it, how it uses it, where it is stored and with whom it is shared. The exercise should go beyond reviewing published privacy policies and examine whether the target’s actual practices are consistent with the representations it makes to individuals and its contractual commitments to customers and business partners.

1. Data Inventory, Processing Activities and Legal Basis

Request a current inventory of personal data processed by the target, identifying the categories of data, the individuals concerned, the purposes of processing, the systems involved and the parties with access to the data.

The review should distinguish sensitive personal data or information governed by the existing SPDI Rules from other personal data. It should also identify data relating to children and any processing that may trigger additional requirements under the DPDP Act once the relevant provisions commence.

The acquirer should examine the basis on which the target collects and processes the data. This includes reviewing consent records and other applicable permissions, contractual commitments, statutory requirements and the purposes communicated to individuals. A mismatch between the stated purpose of collection and the target’s actual use of data can create legal and commercial risks, particularly where the proposed acquisition contemplates new uses of an existing customer database.

2. Privacy Notices and Consent Records

Request the privacy notices, consent forms, consent logs, cookie consent records and other records used to inform individuals about the collection and use of their data. The review should establish whether the records support the target’s account of its processing practices and whether consent, where relied upon, was obtained and documented in accordance with the applicable requirements.

A privacy policy alone may not establish what an individual was told at the time of collection or whether the target’s subsequent use of the data falls within the purpose originally communicated. Acquirers should therefore compare the documented notices and consents with the actual processing activities, including marketing, profiling, sharing with affiliates and transfers to service providers.

3. Data Processors, Vendors and Contractual Commitments

The acquirer should obtain a complete list of data processors, technology vendors, cloud service providers and other third parties that process personal data on the target’s behalf or receive it in connection with their services.

Review the relevant contracts, including data protection clauses, confidentiality obligations, security requirements, breach notification provisions, subcontracting arrangements, audit rights and data deletion or return obligations. The diligence should also identify restrictions on transferring customer or employee data to an acquirer, its affiliates or replacement service providers.

These contractual commitments may affect the feasibility and cost of integration even where no regulatory breach has occurred.

4. Cross-Border Data Transfers and Data Storage

Request a map of cross-border data flows, including the locations of storage, processing, backup and disaster recovery systems. Identify offshore service providers, group entities and other recipients that may access personal data.

Section 16 of the DPDP Act empowers the Central Government to restrict transfers of personal data to specified countries or territories, subject to the applicable framework. It does not impose a blanket prohibition on all cross-border transfers. The acquirer should therefore assess the target’s existing transfer arrangements, applicable contractual or sector-specific restrictions and the potential impact of any restrictions that become applicable under the DPDP framework.

5. Security Incidents, Breach History and Remediation

Request details of actual and suspected data breaches, cybersecurity incidents, unauthorised disclosures, complaints and investigations. The review should establish what happened, which data and individuals were affected, what notifications were made, and what corrective measures were implemented.

Where relevant, examine reports to the Indian Computer Emergency Response Team (CERT-In), sectoral regulators and contractual counterparties, together with internal incident reports, third-party audit findings and records of remediation.

Security certifications and audit reports can provide useful evidence of the target’s controls, but they should not be treated as conclusive proof of legal compliance. The acquirer should also assess access controls, encryption, logging, backup arrangements, vulnerability management and the target’s ability to identify, contain and respond to a data breach.

6. Children’s Data and Significant Data Fiduciary Exposure

The target’s processing of children’s data requires particular attention. The acquirer should identify the data collected, the purposes for which it is processed, the mechanisms used to establish age where relevant, and any parental consent or verification processes that may be required under the DPDP framework.

The diligence should also assess whether the target could be designated as a Significant Data Fiduciary (SDF), taking into account the statutory framework and the factors relevant to such designation. SDFs are subject to additional obligations under the DPDP Act, including requirements relating to a Data Protection Officer, independent data auditor and prescribed assessments and audits.

An acquirer should not assume that every target must appoint a Data Protection Officer solely because it processes personal data. The relevant obligations depend on the applicable legal framework and, under the DPDP Act, the target’s status and any applicable designation.

7. Data Retention, Deletion and Grievance Handling

Request the target’s data retention and deletion schedules, records of deletion and anonymisation, and policies governing data that is no longer required for its original purpose.

The review should identify whether the target retains data longer than necessary, whether deletion commitments can be fulfilled across its systems and vendors, and whether records are preserved where legally required.

Also review the mechanisms through which individuals can raise privacy complaints or exercise applicable rights. The diligence should distinguish existing grievance-handling arrangements from the additional processes that may be required as the relevant DPDP Act provisions commence.

Pricing Unremediated Exposure and Structuring Deal Protections

Privacy diligence should produce more than a list of compliance gaps. The findings should be translated into an assessment of remediation costs, potential liabilities, transaction risks and the steps required to achieve compliance within the relevant timeframe.

1. Assessing Potential DPDP Act Penalties

The Schedule to the DPDP Act prescribes maximum monetary penalties for specified contraventions. These include:

• Up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach.
• Up to ₹200 crore for failure to notify the Data Protection Board of India or affected data principals of a personal data breach, as required by the Act.
• Up to ₹200 crore for contraventions of the additional obligations relating to children under the Act.
• Up to ₹150 crore for contraventions of the additional obligations applicable to Significant Data Fiduciaries.
• Up to ₹50 crore for any other contravention of the Act or rules made under it.

These amounts represent statutory maximums, not automatic penalties for every instance of non-compliance. The nature of the contravention, the applicable statutory provisions and the relevant adjudicatory framework must be considered.

The penalty provisions are scheduled to commence with the relevant later phase of the Act. Accordingly, these amounts should not be presented as penalties already applicable to all current data processing activities. They are nevertheless relevant to forward-looking transaction risk assessment, particularly where a target has material gaps that may remain unresolved when the relevant provisions commence.

For a smaller target, the cost of remediation may be the more immediate concern. For a data-intensive business, the combination of a large dataset, inadequate security controls, weak breach response procedures or extensive processing of children’s data may justify a more detailed assessment of potential exposure.

2. Estimating the Cost of Remediation

The acquirer should prepare a costed remediation plan covering the target’s identified deficiencies. Depending on the business and the data processed, this may include revising privacy notices, implementing appropriate consent-management mechanisms, strengthening access controls, updating vendor contracts, improving retention and deletion practices, and establishing a documented breach response process.

The plan should distinguish changes required to comply with existing law from measures needed to prepare for provisions of the DPDP Act that have not yet commenced. It should also identify the time, resources and dependencies required to implement each measure.

Where material gaps cannot be remediated before closing, the parties may consider reflecting the cost in the transaction valuation, requiring specified actions as conditions precedent, or establishing a dedicated escrow or other contractual mechanism linked to agreed remediation milestones. The appropriate structure will depend on the severity of the exposure, the allocation of responsibility and the commercial terms of the transaction.

3. Data Protection Warranties and Indemnities

Privacy compliance should not be addressed solely through a generic regulatory compliance warranty. A separate data protection schedule can identify the representations that matter to the transaction and provide a clearer basis for assessing any breach.

Depending on the target’s activities, relevant warranties may cover the accuracy and completeness of disclosed processing records, compliance with applicable data protection requirements, the existence and handling of material security incidents, the status of regulatory investigations and the target’s material contractual obligations relating to personal data.

The transaction documents should also address responsibility for losses arising from pre-closing processing that was unlawful under the law applicable at the time. The scope of any indemnity should be negotiated with reference to the identified risk, applicable law, causation, recoverable losses and the agreement’s limitations and exclusions.

Where confirmatory diligence reveals a serious undisclosed breach, material unlawful processing or a significant deficiency that cannot be adequately contained, the acquirer should consider whether the issue warrants a specific remediation obligation, a price adjustment, a condition to closing or, where contractually available, a termination right. The response should be proportionate to the evidence and the materiality of the risk rather than based solely on the theoretical maximum penalty under the DPDP Act.

Post-Closing Integration of Two Data Estates

The diligence exercise does not end at signing. An acquisition can bring together customer, employee and other personal data collected by two organisations under different notices, consent records, contractual arrangements and retention practices.

The commercial objective of integration may be to create a unified customer relationship management system, consolidate service delivery or cross-sell products across the combined customer base. However, the acquirer should not assume that all data collected by the target can automatically be used for every new purpose contemplated after closing. The permissibility of the proposed processing must be assessed under the law applicable to the relevant data and activity, including the DPDP Act as its substantive provisions commence.

1. Reconcile Existing Notices, Consents and Purposes

The starting point is a consent and purpose reconciliation exercise. Map what individuals were told when their data was collected, what permissions were obtained where required, and the purposes for which the data is currently processed.

Compare these purposes with the proposed post-acquisition uses, such as cross-selling, combining customer profiles, centralising analytics or sharing information across group entities. Where a proposed use falls outside the permissions, purposes or other lawful basis applicable to the existing processing, the acquirer should determine what additional notice, consent or other action is required before proceeding.

A fresh consent campaign may be appropriate in some cases, but it should not be assumed to resolve every issue. The feasibility of obtaining consent, the contractual commitments already made and any applicable statutory requirements must be assessed before the data is migrated or repurposed.

Where a proposed new use cannot lawfully be implemented, the parties should consider restricting access to the relevant dataset, retaining it only for permitted purposes, or deleting it when retention is no longer justified and deletion is legally permissible.

2. Harmonise Systems, Contracts and Governance

Post-closing integration should align the operational architecture supporting privacy compliance. This may include harmonising access controls, data inventories, vendor arrangements, retention schedules, deletion processes, complaint handling and incident escalation procedures.

The combined business should also identify who is responsible for privacy governance and regulatory communications. Existing officers and teams may be consolidated where appropriate, but the structure must satisfy the requirements applicable to the organisation. In particular, any obligation to appoint a Data Protection Officer should be assessed by reference to the relevant statutory requirements and the entity’s status.

A single incident response framework can help ensure that security incidents affecting either legacy business are identified, escalated and assessed consistently. The framework should also account for applicable reporting obligations to regulators, affected individuals, customers and contractual counterparties.

3. Reassess Significant Data Fiduciary Status

An acquirer should reassess the combined business’s position under the DPDP framework rather than relying exclusively on the standalone assessment undertaken by either organisation before closing.

The scale and nature of the combined processing activities may affect the government’s assessment of whether an entity should be designated as a Significant Data Fiduciary. The Act provides for consideration of factors including the volume and sensitivity of personal data processed, the risks to data principals, and other prescribed matters.

An increase in the volume of data following a transaction does not, by itself, automatically make the combined entity an SDF. However, the acquisition may change the risk profile and should prompt a fresh assessment of the obligations that may apply.

Practical Checklist for Privacy Due Diligence in an Indian M&A Transaction

Before signing or closing, acquirers should consider whether the diligence exercise has addressed the following:

• A complete inventory of personal data and the purposes for which it is processed.
• Privacy notices, consent records and other applicable legal or contractual permissions.
• Existing obligations under the IT Act, the SPDI Rules and relevant sector-specific requirements.
• Data processor contracts, cloud hosting arrangements and other third-party data-sharing agreements.
• Cross-border data flows, storage locations and applicable transfer restrictions.
• Security incidents, breach reporting, complaints, investigations and remediation.
• Processing of children’s data and potential SDF-related obligations.
• Data retention, deletion, grievance handling and individual rights management.
• A costed plan for remediating current gaps and preparing for DPDP Act commencement.
• Specific data protection warranties, indemnities and other appropriate transaction protections.
• A post-closing plan for reconciling purposes, permissions, systems, vendors and governance arrangements.

Conclusion

Privacy due diligence in an Indian M&A transaction must look in two directions at once: backwards at the target’s compliance with the legal and contractual obligations that already apply, and forwards at the requirements it will need to meet as the DPDP Act’s remaining substantive provisions commence.

Treating the future compliance deadline as someone else’s problem because the principal penalty provisions are not yet in force can leave an acquirer with substantial remediation costs and integration challenges. A data room review built around actual processing and consent records, a valuation exercise that separates remediation costs from potential future exposure, transaction documents tailored to data protection risks, and a disciplined post-closing integration plan can provide a more reliable basis for making and implementing an acquisition decision.

For acquirers, the central question is not simply whether a target has a privacy policy. It is whether the target can demonstrate how personal data is collected, used, protected, retained and shared—and whether those practices can be integrated into the combined business in a manner consistent with the applicable legal framework.

Frequently Asked Questions