What is data privacy due diligence?

Data privacy due diligence is the buy-side review of how a target collects, uses, stores, shares, and deletes personal data, including lawful bases, notices, rights operations, vendors, cross-border transfers, and breach history so price, indemnities, and integration plans reflect real privacy risk.

How is privacy diligence different from cybersecurity diligence?

Cyber diligence focuses on confidentiality, integrity, availability, and security operations. Privacy diligence focuses on lawful processing, transparency, individual rights, purpose limitation, retention, international transfers, and regulatory enforcement under regimes such as GDPR and CCPA/CPRA. Overlap exists on breaches and access control, but the workstreams are not the same.

What privacy laws matter most in M&A diligence?

Common anchors include GDPR and UK GDPR for EEA/UK data subjects, CCPA/CPRA and other U.S. state privacy laws, sector rules (HIPAA, GLBA, COPPA), and local regimes where the target operates. Buyers map which laws actually apply based on geography, data types, and business model.

How long does traditional privacy due diligence take?

Specialist privacy counsel reviews often run one to four weeks depending on multi-jurisdiction scope, data-room quality, and whether DPIAs, transfer tools, or prior enforcement need deep review. Fees commonly range from roughly $15,000 to $100,000+ for middle-market multi-regime targets.

What are common privacy deal-killers?

Common deal-killers include unlawful sale or sharing of personal data at scale, missing or invalid transfer mechanisms for EU data, material undisclosed breaches with regulatory exposure, systematic failure to honor deletion or access rights, and product features that cannot be made compliant without core re-architecture.

Should privacy diligence start before LOI?

Yes for a light screen. Public privacy policies, cookie banners, app permissions, breach news, sector risk, and high-level questionnaires belong in pre-LOI triage. Deep ROPE reviews, DPIA sampling, and counsel negotiations usually ramp after LOI when the data room opens.

What is a processing inventory or ROPE in diligence?

A record of processing activities (ROPA/ROPE) maps purposes, categories of data subjects and data, recipients, retention, and safeguards. Buyers use it to test whether the target actually knows its data footprint or is flying blind.

Can a public-info first-pass help before hiring privacy counsel?

Yes for triage. A structured public-information pack can flag multi-jurisdiction exposure, weak notices, high-risk product patterns, disclosed incidents, and concentration of personal-data operations before you fund full specialist review. It is screening research, not a legal opinion, audit, or certification.

Data Privacy Due Diligence: GDPR, CCPA & Privacy Program Guide for PE & M&A

Privacy / data-protection workstream

Privacy pillars

Checklist items

$15K+

Specialist start

$49

First-pass pack

What data privacy due diligence covers

Data privacy due diligence is the workstream that asks whether personal data is processed lawfully, transparently, and in a way that survives close. It is not a synonym for cybersecurity. Cyber asks whether systems can be breached. Privacy asks whether the business is allowed to collect and use the data it has, whether individuals can exercise rights, and whether regulators or class plaintiffs have a clean path to post-close pain.

Scope expands for consumer apps, adtech, marketplaces, healthcare, fintech, HR-tech, B2B SaaS with end-user telemetry, and any company with EU/UK users or multi-state U.S. consumer data. Enterprise B2B sellers still need vendor DPAs, employee data hygiene, and product telemetry review. Light "we only have business emails" stories often fail under scrutiny.

Six pillars of privacy diligence

Pillar	What you prove	Typical owners
1. Data map & inventory	Systems, purposes, categories, volumes, retention, owners	Privacy + engineering + legal
2. Lawful basis & notices	Consent/contract/legitimate interests, policies, cookies, product UX	Privacy counsel + product
3. Rights & ops (DSAR)	Access, deletion, correction, portability, opt-out workflows	Ops + support + privacy
4. Transfers & vendors	Cross-border tools, SCCs, DPAs, sub-processors, sales of data	Legal + procurement
5. Incidents & enforcement	Breach log, regulator contact, complaints, class risk	Legal + security + privacy
6. Close & go-forward	SPA privacy reps, post-close program, budget, DPO/roles	Deal counsel + buyer privacy

When each stage runs

Stage	Typical work	Access needed	Decision use
Pre-LOI screen	Public policy/cookie review, app permissions, breach news, sector risk	Public only	Kill or price privacy risk early
Post-LOI data room	ROPA, DPIAs, DPAs, breach register, transfer tools, complaints	VDR	Confirm underwriting; plan holdbacks
Specialty deep dive	Counsel review of high-risk products, prior enforcement, dark patterns	Counsel + product demos	Structure indemnities and fixes
Pre-close / day-1	Reps schedule, budget, DPO/privacy owner, remediation plan	Board/ops authority	Fund path + compliance continuity

Cost reality: specialist privacy DD vs first-pass screen

Traditional privacy diligence (privacy counsel + multi-regime review) often starts around $15K–$100K+ for middle-market multi-jurisdiction targets and scales with adtech, health data, or prior enforcement. A structured public-information pack at $49 (or $39.20 with DI20-WELCOME) helps deal teams triage privacy-heavy names before funding full specialty scopes.

Order first-pass $39.20 → See sample report

Red flags (deal-killer / high / watch)

Severity	Signal	Why it matters
Deal-killer	Unlawful sale/share of personal data at material scale	Enforcement + class + product redesign
Deal-killer	EU/UK data transferred without valid transfer mechanism	Stop-processing risk; hard remediation
Deal-killer	Material undisclosed breach with active regulator inquiry	Unknown fine and reputation load
High	No usable processing inventory / ROPA	Unknown footprint; integration landmines
High	DSAR / deletion backlog or systematic non-compliance	Statutory clocks; class catalyst
High	Children's data or sensitive categories without controls	Heightened regimes (COPPA, HIPAA, etc.)
Watch	Stale privacy policy vs product reality	Usually fixable; still a signal of weak ops
Watch	Vendor DPAs missing for low-risk tools only	Admin debt if core vendors are covered

Cost and timeline comparison

Approach	Typical cost	Timeline	Best use
Public first-pass pack	$49 / target	Minutes to same day	Screen many names before LOI
Counsel privacy memo (single regime)	~$10K–$35K	1–2 weeks	Clear primary jurisdiction
Multi-regime privacy DD + product review	$25K–$100K+	2–4 weeks	Consumer/global data-heavy targets
Forensic / breach residual review	Deal-specific	Parallel to confirmatory	Prior incidents or open inquiries

50-point data privacy due diligence checklist

Use as a buyer workplan. Tag items Deal-Killer / High / Watch as evidence arrives. Groups below mirror how deal teams staff the privacy workstream.

A. Inventory, purposes & systems (1–10)

Processing inventory / ROPA covering core products and support
Categories of data subjects (customers, end users, employees, prospects)
Special-category / sensitive data flags (health, biometrics, finance, children)
System list: production DBs, warehouses, CDPs, analytics, support tools
Retention schedules vs actual storage (backups, logs, warehouses)
Data owners and stewards named per major system
Employee / HR data systems and cross-border HR processing
Marketing / sales stack (CRM, enrichment, outbound tools)
Product telemetry, session replay, and fingerprinting practices
Shadow IT and unapproved SaaS processing personal data

B. Lawful basis, notices & product UX (11–20)

Lawful basis matrix by purpose (consent, contract, LI, legal obligation)
Privacy notice accuracy vs product and marketing reality
Cookie / tracking consent mechanism quality (if EU/UK or similar)
In-product privacy settings and default choices
Dark-pattern risk in consent or cancel flows
CCPA/CPRA "Do Not Sell or Share" and GPC handling where applicable
Children's data age gates and parental consent where relevant
Automated decision-making / profiling disclosures
Employment privacy notices and monitoring policies
Contractual privacy terms with customers (DPA / MSA schedules)

C. Rights operations & DSAR (21–30)

Documented DSAR intake channels and identity verification
SLA performance vs statutory timelines (access, deletion, correction)
Deletion completeness across production, backups, vendors
Portability export format and coverage
Opt-out of sale/share and targeted advertising workflows
Volume trend of rights requests last 12–24 months
Complaint and appeal handling process
Training for support and sales on privacy requests
Known backlog or workarounds that leave residual data
Integration of rights ops with product identity graph

D. Vendors, transfers & sharing (31–40)

Sub-processor list current and disclosed where required
DPAs / SCCs in force for material processors
International transfer map (EEA/UK/US and others)
Transfer impact assessments for high-risk routes
Data sales, broker relationships, and enrichment sources
Adtech / pixel / server-side tagging inventory
Onward transfer restrictions in customer contracts
Vendor security questionnaires for privacy-critical processors
Open-source and free-tier tools handling personal data
M&A data-room sharing controls (buyer diligence itself)

E. Incidents, enforcement & close (41–50)

Breach and security-incident register (privacy-relevant events)
Regulator correspondence, inquiries, orders, settlements
Class actions, demand letters, AG investigations
DPIAs / PIAs for high-risk processing
DPO / privacy officer role (or justified absence)
Privacy training completion and policy acknowledgment
Budget and headcount for privacy program post-close
SPA privacy reps, schedules, and knowledge qualifiers
Remediation plan with owners and cost for known gaps
Day-1 integration constraints (systems that cannot merge yet)

Privacy vs cyber vs legal vs regulatory

Workstream	Primary question	Overlap with privacy
Cybersecurity DD	Can systems be compromised?	Breach impact, access control, encryption
Legal DD	What contracts and liabilities bind the company?	DPAs, customer MSAs, litigation
Regulatory DD	What licenses and supervisors govern the business?	Sector privacy rules, consent orders
Privacy DD	Is personal data processed lawfully and accountably?	Core: inventory, rights, transfers, notices

How deal teams use first-pass privacy screening

Before LOI, teams rarely get a full ROPA. They still can: (1) read public privacy and cookie notices against the live product; (2) note multi-jurisdiction language and high-risk data types; (3) search for breach disclosures and enforcement news; (4) score whether the business model depends on data sale, heavy tracking, or sensitive categories; (5) shortlist names that need early privacy counsel vs names that can wait for confirmatory. A $49 structured pack is built for that triage layer — not as a substitute for counsel opinions or certifications.

Surface privacy risk before you price the deal

Order a structured first-pass diligence pack on a named target, or start with a free brief. Specialist privacy counsel still owns multi-regime opinions — use public screening to spend that budget on the right shortlist.

Order report $39.20 → Free brief Sample report