A target’s personal data processing is a contingent liability. AMLEGALS maps the DPDPA exposure — Section 5 notice adequacy, Section 6 consent integrity, Section 8(5) safeguard maturity and Rule 7 breach history — and structures the risk allocation in the transaction documents.
In every M&A transaction, the acquirer inherits the target’s data protection posture. Under the Digital Personal Data Protection Act 2023, that posture is no longer a compliance nicety — it is a contingent liability with penalties up to ₹250 crore under the Schedule. A target that has been processing personal data without itemised notices under Section 5, without valid consent under Section 6 or without reasonable security safeguards under Section 8(5) creates exposure that crystallises on the first complaint to the Data Protection Board after closing.
AMLEGALS conducts DPDPA due diligence as part of the legal due diligence workstream, mapping the target’s data inventory, processing purposes, consent records, third-party processor contracts, cross-border data flows, breach history and response capability. The findings are translated into risk-adjusted representations, indemnities and conditions precedent in the SPA or SHA. Post-closing, the practice assists in integrating the target’s privacy programme with the acquirer’s framework within the compliance timeline.
Cataloguing every category of personal data the target processes, the lawful basis (consent or legitimate use), the systems and processors involved and the cross-border flows.
Assessing every Section 5 notice for itemisation and clarity, and every Section 6 consent record for validity, granularity and withdrawal mechanism.
Reviewing Section 8(5) safeguards — encryption, access controls, incident response — against the processing volume and sensitivity.
Analysing every past or pending breach, the Rule 7 intimation timeline, remediation steps and residual exposure.
Auditing Section 8(2) processor contracts and Section 16 cross-border transfer mechanisms for adequacy.
Drafting DPDPA-specific representations, warranties, indemnities, escrow provisions and conditions precedent.
The Digital Personal Data Protection Act 2023 imposes obligations on every Data Fiduciary. An acquirer inheriting non-compliant processing — inadequate notices under Section 5, missing consent under Section 6 or weak safeguards under Section 8(5) — inherits the penalty exposure under the Schedule (up to ₹250 crore for safeguard failures). DPDPA due diligence maps this exposure before the deal closes, allowing risk allocation in the transaction documents.
The scope covers seven areas: personal data inventory and data-flow mapping, Section 5 notice adequacy, Section 6 consent records and withdrawal mechanism, Section 7 legitimate-use reliance, Section 8(5) security safeguards, Section 8(6) and Rule 7 breach history and response capability, and processor and sub-processor contracts under Section 8(2). For targets that may be Significant Data Fiduciaries, Section 10 compliance — DPO appointment, DPIA and audit — is additionally reviewed.
Representations and warranties should cover the target’s compliance status, pending complaints before the Data Protection Board, outstanding breach intimations and cross-border transfer mechanisms under Section 16. Indemnities are calibrated to the Schedule penalties. Conditions precedent may include remediation of identified gaps — particularly where the target has no itemised notice or no mechanism for consent withdrawal as easy as consent under Section 6(4). Escrow or holdback provisions are common for identified but unquantified breach exposure.
Yes. In a share purchase, the target entity continues as the Data Fiduciary. Its obligations under the DPDPA — notice, consent, safeguards, breach response, Data Principal rights — persist unchanged. The acquirer, as the new controlling shareholder, bears the governance risk of any non-compliance. In an asset purchase where personal data is part of the acquired assets, additional consent or notice may be required depending on whether the original purpose under Section 5 covers the new fiduciary.
Section 16 restricts transfer of personal data to countries not notified by the Central Government. If the acquirer’s parent is in a non-notified jurisdiction, the post-closing data architecture must ensure that personal data of Indian Data Principals is not transferred there without a lawful mechanism. Rule 15 of the DPDP Rules 2025 subjects cross-border transfer to any requirements the Central Government specifies by order, and sectoral localisation rules apply independently. Cross-border M&A due diligence must map every data flow that will change post-closing.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing.
Share the target profile and transaction timeline for a confidential assessment of data privacy risk.