India’s digital landscape is undergoing a significant transformation with the advent of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the subsequent Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). While much of the initial discourse has rightly focused on the broad implications for data subjects and businesses in general, a critical area demanding attention is the profound impact these regulations will have on mergers and acquisitions (“M&A”) in India. The DPDP Rules are poised to fundamentally reshape how M&A due diligence is conducted, how transaction structures are negotiated, and how data privacy risks are allocated, drawing parallels with the significant shifts observed under the European Union’s General Data Protection Regulation (“GDPR”).

Heightened Due Diligence Requirements

For M&A deal teams, data privacy compliance will transition from a peripheral concern to a central pillar of due diligence. Acquirers must now undertake a meticulous examination of target companies’ data protection frameworks to identify, quantify, and mitigate potential legal, financial, operational, and reputational risks arising from non-compliance with the DPDP Rules.

This means a new level of scrutiny on:

Data Inventories and Mapping: Understanding what personal data a target collects, processes, stores, and shares.
Consent Mechanisms: Validating the legality and robustness of consent obtained from Data Principals (data subjects) for various processing activities.
Data Protection Policies and Procedures: Assessing the adequacy and effectiveness of internal policies, incident response plans, and data retention schedules.
Third-Party Vendor Management: Evaluating the target’s contractual arrangements with data processors and other third parties to ensure DPDP compliance flows down the chain.
Security Measures: Reviewing technical and organisational safeguards against data breaches and unauthorised access.
Data Breach History: Investigating any past breaches, their resolution, and compliance with reporting obligations.
Due Diligence on International Data Flows (as applicable): Acquirers will need to understand where and how the target company transfers personal data outside India and ensure these transfers align with DPDP requirements, including any necessary standard contractual clauses or governmental notifications.

Comparison with GDPR: Companies operating in Europe have, for years, integrated comprehensive GDPR due diligence into their M&A playbooks. The DPDP Rules create a similar, albeit distinctly Indian, checklist for targets, making non-compliance a significant red flag that can impact deal viability and valuation.

Allocation of Data Privacy Risk

The financial penalties stipulated under the DPDP Act for non-compliance are substantial, creating a strong incentive for acquirers to re-evaluate the allocation of data privacy risks within transaction documents. Sellers will face increased pressure to provide robust representations and warranties regarding their adherence to data protection laws.

Key areas of negotiation will include:

Specific DPDP Warranties: Acquirers will demand detailed warranties confirming compliance with all aspects of the DPDP Act and Rules, including valid consent, legitimate use, and appropriate security measures.
Indemnification for Data Breaches and Non-Compliance: Sellers may be required to offer specific indemnities for pre-acquisition data breaches or existing non-compliance issues that come to light post-closing, protecting the buyer from fines, regulatory actions, and litigation costs.
Escrow Arrangements: A portion of the purchase price may be held in escrow to cover potential liabilities arising from identified or unknown data privacy risks, particularly in cases where the target’s data protection posture is uncertain.
Material Adverse Change Clauses: Data privacy breaches or significant regulatory investigations could be explicitly included as events triggering a MAC clause, allowing buyers to renegotiate or even terminate a deal.

Comparative Approach: Lessons from GDPR-impacted deals highlight how contractual mechanisms adapted to address privacy risks. The DPDP Rules necessitate a similar evolution in Indian M&A agreements, moving beyond generic “compliance with laws” clauses to privacy specific provisions.

Impact on Transaction Timelines and Valuation

The increased complexity of data privacy due diligence and risk allocation can inevitably impact transaction timelines and, potentially, valuation.

Extended Due Diligence Periods: Comprehensive data privacy audits may require additional time and specialist expertise, potentially prolonging the due diligence phase.
Valuation Adjustments: Identified compliance gaps, potential liabilities, or the cost of remediation efforts could lead to downward adjustments in the target company’s valuation. Companies with mature data protection frameworks will likely command a premium, while those with significant deficiencies may face discounts.
Conditions Precedent: Remediation of critical data privacy non-compliance issues might become a condition precedent to closing, potentially delaying the transaction until rectified.

Challenges in Enforcement During Post-Merger Integration

The integration phase post M&A poses its own set of challenges regarding DPDP compliance. Aligning disparate data protection policies, consolidating IT systems, and harmonizing consent frameworks across merged entities can be complex.

Policy Harmonisation: Developing a unified data protection policy and ensuring its consistent application across the merged entity.
System Integration:Merging IT systems while ensuring data security and privacy by design principles are upheld.
Legacy Data Issues: Addressing personal data collected by the target under previous regimes and ensuring its continued processing aligns with DPDP requirements.

Training and Awareness: Educating employees of the combined entity on the new unified data protection obligations.

The DPDP Rules are not just another regulatory hurdle, they are a fundamental shift in India’s legal landscape with profound implications for M&A. For corporate lawyers, dealmakers, and businesses, understanding and proactively addressing DPDP compliance is paramount. Companies that embed data protection into their core strategy and operational framework will be more attractive targets, facilitating smoother transactions and reducing post-acquisition liabilities. As India continues its digital growth, the interplay between data privacy and deal-making will define the success and security of M&A transactions in the years to come.

Data Protection Meets Deal Making: How India’s DPDP Rules Are Shaping the Future of M&A