When a company is transferred (whether through mergers, demergers, sales and acquisitions of securities, etc.), attention often focuses on traditional assets: customers portfolios, key contracts, key employees, intellectual property, core business’ platforms and systems, etc.
However, personal data also enters this equation: it can constitute a significant part of the target’s valuation, provided that its processing effectively complies with the applicable regulations (GDPR). Any non-compliant target company represents a multifaceted risk for the buyer:
Although the term “GDPR” is now firmly entrenched in people’s minds and has gradually led companies to strengthen their compliance process, many of them are still reluctant to do so. While the reasons for this are varied, they reveal the same off-putting, time-consuming, expensive and/or economically sterile perception of the construction site:
“Appropriate time” … which, in practice, never occurs, until the day the CNIL knocks on the door:
However, in a transfer process:
It is therefore imperative to get rid of this persistent idea once and for all: GDPR compliance is not the prerogative of any specific category of companies, whether they are listed or not, whether they operate on internet or not, whether they manage a significant or lesser volume of “data”.
GDPR compliance concerns all entities, as long as they process the data of their employees or agents, customers, users or users of online platforms, suppliers or partners, etc.
Administrative fines can reach €20 million or 4% of worldwide turnover (excluding a simplified procedure capped at €20,000).
In addition, criminal penalties of up to 5 years imprisonment and a €300,000 fine, civil damages, and a major reputational risk related to the publication of the penalties can be added. Indeed, in the age of social networks, whistleblowers and the de-anonymization of sanctions pronounced by the CNIL, damage to company’s image is becoming strategic. The costs of responding are often much higher than those of initial compliance.
To be convinced, it is enough to look at the profile of the companies sanctioned by the CNIL in 2025, in addition to those widely reported in the press:
Beyond these “classic” sanctions, GDPR non-compliance can also now be a basis for initiating an unfair competition action. Indeed, a company that dispenses the investments necessary for compliance (system updates, audits, data security, internal training, etc.) can benefit from an undue competitive advantage (cost reduction, speed of execution, wider data collection, etc.) to the detriment of regulator-compliant players. The latter can then engage the civil liability of the “non-compliant” target to obtain compensation. In an M&A context, this risk becomes strategic for the acquirer who “inherits” the target’s liabilities: an unfair competition action initiated post-closing can not only generate significant damage but also degrade the image and market position of the integrated target.
📌 This is why a pre-acquisition GDPR audit is essential, in order to identify any non-compliant practices likely to engage the target’s liability or even justify an unfair competition action on the part of a competitor, then to quantify the financial exposure and thereafter to provide for the appropriate contractual protection mechanisms.
The target’s GDPR compliance management choices have a real impact on its financial and asset estimate.
The more the cursor moves towards compliance, the less the buyer will have to invest later to compensate for past shortcomings and, on the seller’s side, the better the valuation will be.
Conversely, and very mechanically, if the compliance cursor remains more or less at a standstill, the value of the target will inevitably be challenged by the buyer, and the negotiation of liability guarantees and other similar mechanisms will have their moment of glory, invariably to the detriment of the seller.
It is a structured, cross-functional process (HR, Legal, IS, Purchasing, Sales/Marketing, etc.), often accompanied by external service providers. This process results in the production of documented “evidence of compliance” at a given time, in accordance with the principle of accountability.
Because these evidentiary documents must be adapted to the subsequent changes in processing and regulations, or even the implementation of new processing operations: GDPR compliance is essentially a long-term process, the aim being to ensure the long-term protection of individuals and their data. It is these “proofs of compliance” that are intended to be placed in the seller’s data room.
🔍 “Proofs of compliance” include :
In theory, and when GDPR compliance is indeed part of the vendor’s DNA, the deliverables concerned will be immediately integrated into an ad hoc directory in the data room.
In the opposite hypothesis, their absence is a very first signal as to the degree of “GDPR-maturity” of the target, although in practice, other indicators are also to be considered. This will include late, dispersed or drip-drip communication of expected or directly requested elements, or a mass mailing as the closing date of the data room approaches. Quite frequently, the information will be distributed in different directories of the data room, including technical, operational or accounting information, with the responsibility of the prospective buyer to sift through each of them within the given deadlines.
While such “tactics” are well known, they nevertheless pose a risk of incompleteness of the analysis, a risk that is all the more significant since the elements actually transferred to the data room will be deemed to have been brought to the attention of the prospective buyer and, as long as they are stamped “disclosed”, generally excluded from the guarantees and similar mechanisms of the acquisition contract.
The study of the documents issued in application of the principle of accountability will highlight any contradictions or inadequacies and will ultimately make it possible to assess the degree of GDPR compliance of the target as well as, therefore, the cost of the corrective measures to be implemented, in addition to the cost of proven non-compliance in terms of administrative and/or criminal sanctions, damage to image or reputation and/or damages. The overall envelope thus estimated will constitute a lever for negotiating the sale price initially envisaged, in addition to generating contractual safeguards in the deeds of acquisition.
The analysis of “proof of compliance” documents is essential as it allows them to:
The deeds of sale and acquisition of the target must integrate the results of the GDPR audit to secure the parties.
This necessarily involves the drafting and negotiation of specific clauses to mitigate the risks of liability as much as possible.
✅ Strategic recommendations before/during/after the operation
| Phases | Key recommendations |
|---|---|
📅 Before Preparing for sale and valuation |
|
🖋️ During Securing acts |
|
🔄 After Capturing value |
|
| ✅ Do | ❌ Don’t |
|---|---|
Prepare a comprehensive GDPR checklist and share it with legal counsels to target priority checkpoints | Settling for a vague statement from the seller (“everything is compliant”) without documentary verification |
Require the full availability of “proof of compliance” (register, PIA, internal policies, subcontractor contracts, etc.) in the data room | Accept that key documents are transmitted outside the data room, by e-mail or late, making traceability impossible |
Check the consistency between the documents provided and the operational reality (interviews, site visits) | Rely solely on documents, without validation in the field or by interview of business managers |
Insert specific GDPR clauses into the SPA with quantified and dated liability guarantee and remediation obligations | Forgetting to include GDPR clauses or settling for general non-binding wording |
Make deferred payment / price adjustment conditional on compliance with post-closing GDPR commitments | Paying the full price without a protective mechanism when compliance gaps have been identified |
Provide for a right to post-closing audit within a defined period of time to confirm announced compliance | Waive any possibility of control after signing, limiting the scope of guarantees |
In the age of data, GDPR compliance is no longer a luxury or an administrative burden.
It becomes a criterion of governance, a lever for valuation and a vector of confidence in any M&A transaction.
A compliant company doesn’t just protect the data it processes; it also protects the value of its assets, its reputation, and its growth prospects.