Personal data in an M&A data room: purpose, recipients and erasure

Personal data may be disclosed in an M&A data room only for a defined due diligence purpose and to the extent that the review requires it. Before an upload, the parties should therefore identify the data categories, legal basis, recipients, access rights and the treatment of the material after the transaction ends.

A data room often contains contracts, employment records, customer information, contact details, disputes, financial material and technical logs. Calling the project a transaction does not complete the GDPR assessment. This article explains how to prepare the selection and disclosure of data without turning the entire business archive into an unrestricted copy for every participant.

An M&A data room is an organised disclosure of documents to a defined group of people. Processing starts with selecting, assembling and structuring the documents. It therefore also covers files that are never opened. The parties should record the transaction stage, the review question and the intended recipient group before granting access.

Personal data can appear in almost every business document. Examples include names and contact details in contracts, employee information, customer and supplier relationships, payment data, support records, access logs and dispute files. The fact that the company already holds this information does not by itself permit disclosure to prospective buyers.

Article 5(1)(a) to (c) and (f) GDPR requires lawful, fair and transparent processing, purpose limitation, data minimisation and appropriate security. The data room therefore needs its own release decision. A blanket folder share merely moves the actual assessment to the recipients.

The purpose should describe the transaction and the review area that actually requires the information. Assessing a purchase price, reviewing contractual risks and preparing an integration decision may call for different data. For each operation, identify which information is required for which decision and who makes that decision.

Article 6(1) GDPR requires an appropriate legal basis for processing. Depending on the circumstances, this may involve a legal obligation, a contract, legitimate interests or another basis under the Regulation. If legitimate interests are relied on, the parties should document the interest assessment and the impact on the data subjects.

The information duties under Articles 13 and 14 GDPR remain relevant. Data subjects should generally receive understandable information about the purposes and recipients of processing. A notice that refers only to a possible transfer of the business may leave the actual data flow too vague.

The data list should distinguish master data, contract data, communications, financial information, employee records and technical logs. For each category, record why it is required for the review. Free text, private contact details and complete email chains often contain additional information without a connection to the transaction.

Special categories under Article 9 GDPR require a separate assessment. This may include health information in employment records or information about trade-union membership. Article 10 GDPR applies to personal data relating to criminal convictions and offences. Such information belongs in the released scope only where there is a concrete review need and an appropriate legal basis.

Redaction, staged access and aggregated information can support the review. A redacted record must still serve the concrete decision. The release record should state what was removed, who checked the redaction and under which conditions a later disclosure may be considered.

The target company or seller may be the controller for assembling the material. A prospective buyer may have its own responsibility for the assessment it makes. Advisers may be controllers, joint controllers or processors depending on their mandate and decision-making power. The data-room provider may process data on instructions for one activity and have a different role for its own functions.

Article 4(7) to (9) GDPR focuses on purposes, means, instructions and actual receipt. Article 24 requires appropriate measures by the controller. Articles 26 and 28 address different arrangements. A clause in the purchase agreement or data-room contract cannot make the actual organisation of processing disappear.

The article on joint controllership with an agency or platform explains the Article 26 assessment. The question whether a technical provider acts on instructions or pursues its own purposes is developed in the article on SaaS agreements and controller or processor roles. Both assessments concern the concrete flow of data.

A user should see only the document groups required for the assigned task. The buyer team, auditors, legal advisers, financing partners and technical reviewers will often need different extracts. Article 25 GDPR requires data protection by design and by default. The data room should reflect that requirement through roles, groups and approvals.

Article 32 GDPR requires a level of security appropriate to the risk. Measures may include strong authentication, permission management, encryption, logging, download restrictions and controlled support access. These measures document the technical organisation, but they do not answer whether a specific category may be disclosed at all.

Review exports, screenshots, local folders, printouts and backups as well. A data room can log platform access without controlling later use. Approvals should therefore record the responsible person, period, document group and end of the permission.

Article 5(1)(e) GDPR requires personal data to be kept in a form allowing identification only for as long as necessary for the purposes. After completion, particular records may still be needed for the contract or legal defence. After termination, the parties should decide which material is returned or erased and which limited evidence may remain.

Article 17 GDPR must be considered together with statutory retention duties, legal claims and other restrictions on erasure. It does not create one fixed period for every data-room record. For each category, the decision should state the purpose, legal basis, end event, storage location and responsible party.

For a processor, Article 28(3)(g) GDPR requires the contract to address deletion or return after the end of the services unless Union or Member State law requires storage. Article 30 supports the record of processing activities. Copies held by advisers must be tracked separately because deleting the data-room record does not automatically delete those copies.

If a buyer, adviser, support team or sub-processor accesses the data from outside the European Economic Area, Chapter V GDPR must be assessed. This can matter even where the provider is contractually based in Europe if support, administration or sub-processing involves third-country access.

Articles 44 to 49 GDPR require the transfer and subsequent processing to provide a level of protection consistent with the Regulation. The assessment should cover the recipient, data categories, access routes, transfer tool, supplementary safeguards and the actual technical chain. The location of the data centre does not answer every question.

Article 48 GDPR concerns judgments or decisions of third-country authorities or courts. Standard contractual clauses under Article 46 can be one transfer tool, but they do not remove the need to assess the remaining circumstances. The decision matrix should therefore include support channels, remote administration, sub-processors and the response to authority requests.

A useful matrix connects the data category, specific purpose, legal basis, data subjects, recipients, role, access, third-country element, storage location, erasure event and responsible person. It should also show whether information is aggregated, redacted, released in stages or withheld entirely.

Article 5(2) GDPR requires responsibility for compliance with the principles. Article 24 requires appropriate measures and their review. The evidence should therefore contain more than a signed checklist. The version, reviewer, release date, changes to the buyer group and technical implementation should be kept together.

A data protection impact assessment under Article 35 GDPR may be required where processing is likely to result in a high risk to the rights and freedoms of natural persons. The decision matrix does not replace that assessment. It provides a basis for evaluating the risk, safeguards and release decision in a traceable way.

We review the transaction stage, data categories, purpose and legal basis, recipients and roles, access chain, third-country elements and the return and erasure concept. For an initial assessment, the data-room structure, release matrix, proposed user groups, provider agreements and planned evidence are useful. Contact us if personal data for due diligence should be defined safely before an upload.