GDPR and Cross-Border Due Diligence: Compliance Framework

Quick answer

Cross-border due diligence must comply with GDPR (EU), CCPA (California), and local data protection laws when processing personal data of target company employees, customers, and vendors. Key requirements: lawful basis for processing (legitimate interest for DD), data minimization (only necessary personal data), Standard Contractual Clauses (SCCs) for international transfers, and Data Protection Impact Assessments (DPIAs) for high-risk processing. Non-compliance carries fines up to 4% of global annual revenue under GDPR.

Cross-border M&A transactions multiply the complexity of data protection compliance. When a US buyer acquires a European target, the due diligence process itself involves processing personal data of EU residents — triggering GDPR obligations before the deal even closes.

When Data Protection Laws Apply to DD

GDPR applies whenever due diligence involves personal data of EU/EEA individuals:

• Employee data: Names, titles, compensation, benefits, performance reviews, disciplinary records
• Customer data: Contact information in contracts, CRM records, purchase history
• Vendor data: Contact persons, payment details, contract terms
• Board and officer data: Compensation, shareholdings, employment agreements

CCPA applies similarly for California residents' personal information. Other jurisdictions (UK GDPR, Brazil LGPD, China PIPL) have their own requirements.

The DD Data Protection Framework

Step 1: Lawful Basis Assessment

Before processing any personal data, establish the legal basis:

• The buyer has a legitimate interest in evaluating the target company
• This interest must be balanced against data subjects' privacy rights
• Document the balancing test in a Legitimate Interest Assessment (LIA)
• Apply data minimization — process only personal data necessary for DD purposes

• Impractical to obtain consent from thousands of individuals during DD
• Consent must be freely given, which is questionable when employment is involved
• Use legitimate interest instead

Step 2: Data Minimization

Apply strict data minimization during DD:

• Anonymize where possible — Replace names with identifiers in compensation analysis
• Aggregate data — Use salary bands rather than individual compensation figures
• Limit access — Only team members with legitimate need access personal data
• Purpose limitation — Process data only for DD evaluation, not for marketing or other purposes

Step 3: International Transfer Mechanisms

For cross-border deals, personal data transfers require safeguards:

• Standard Contractual Clauses (SCCs) — Contractual commitments between data exporter and importer
• Transfer Impact Assessment (TIA) — Assess whether destination country provides adequate protection
• Supplementary measures — Encryption, pseudonymization, access controls as needed

• Transfers to countries with EU adequacy decisions (UK, Switzerland, Japan, South Korea, etc.) proceed without additional mechanisms
• US Data Privacy Framework provides limited adequacy for certified companies

Step 4: Data Protection Impact Assessment

For high-risk DD processing, conduct a DPIA:

• Identify risks: What personal data is processed? How? By whom? Where?
• Assess necessity: Is this processing strictly necessary for DD purposes?
• Evaluate risks: What are the risks to data subjects if data is breached or misused?
• Implement safeguards: Encryption, access controls, data minimization, retention limits
• Document everything: Written DPIA maintained for regulatory inspection

DD-Specific GDPR Compliance Checklist

1. 1. Lawful basis documented — LIA completed before processing begins
2. 2. Data minimization enforced — Only necessary personal data accessed
3. 3. Transfer mechanisms in place — SCCs or other safeguards for international transfers
4. 4. DPIA completed — For large-scale or high-risk processing
5. 5. Retention policy defined — Personal data deleted after DD completion (failed deals) or retained with basis (completed deals)
6. 6. Breach notification process — Procedures for 72-hour notification under GDPR Article 33
7. 7. Vendor due diligence — DD platform/VDR confirmed as compliant data processor
8. 8. Privacy notice — Target company's privacy notice covers DD data sharing (or seller provides appropriate justification)

Target Company GDPR Compliance as DD Finding

The target's own GDPR compliance posture is a DD finding:

These findings affect purchase price, indemnification provisions, and post-close compliance budgets.

The Bottom Line

GDPR compliance in cross-border DD is not optional — it is a legal requirement with enforcement penalties up to 4% of global turnover. Deal teams that build data protection into their DD process from day one avoid regulatory exposure and create a stronger compliance posture post-close.

Sources cited

1. Deloitte, '2025 GenAI in M&A Study,' 2025
2. PwC, '2024 M&A Outlook,' 2024

Author

Sorai Editorial

Editorial review team for Sorai's public diligence content

The editorial team translates public primary-source research and Sorai's workflow perspective into material designed for private equity, corporate development, and transaction advisory readers.

Does GDPR apply to M&A due diligence?

Yes. When due diligence involves processing personal data of EU/EEA individuals (employees, customers, vendors of the target), GDPR applies. This includes employee names, compensation data, customer PII in contracts, and vendor contact information. The buyer must establish a lawful basis for processing.

What is the lawful basis for processing personal data during DD?

Legitimate interest (Article 6(1)(f) GDPR) is the most common basis, balanced against data subjects' rights through a Legitimate Interest Assessment. Consent is generally impractical during DD. Data minimization requires limiting processing to only necessary personal data.

How do you transfer DD data internationally?

International data transfers from the EU/EEA require transfer mechanisms: Standard Contractual Clauses (SCCs) for transfers to non-adequate countries, adequacy decisions (UK, Japan, etc.), or binding corporate rules. Post-Schrems II, supplementary measures may be required.

What are the penalties for GDPR non-compliance in M&A?

Administrative fines up to €20 million or 4% of total worldwide annual turnover. Additionally, target company GDPR violations discovered during DD can reduce purchase price, trigger specific indemnities, and create post-close compliance obligations for the buyer.

Review the controls

Pair the article with the platform and security pages.

Use the routes below to inspect how Sorai frames sensitive deal-data handling, workflow governance, and review-readiness.

Security

Data Security in M&A Transactions: Protecting Deal-Critical Information

Data security in M&A is a control problem, not just a storage problem. This guide covers the platform, workflow, and team practices that protect deal-critical information.

SOC 2

SOC 2 Compliance for Due Diligence Platforms

SOC 2 matters for due diligence platforms because buyers need evidence that security controls are designed, tested, and relevant to confidential M&A workflows.

Legal DD

Legal Due Diligence Checklist: Contracts, IP, Litigation, and Compliance

Legal DD evaluates material contracts, IP ownership, litigation exposure, employment matters, and regulatory compliance. This checklist covers every area with specific items to investigate.