M&A Privacy Due Diligence: A Comparative Look at DPDPA, GDPR, and CCPA
As M&A activity continues its global pace, privacy due diligence has evolved from a peripheral concern to a critical deal-breaker. For Indian businesses, the Digital Personal Data Protection Act, 2023 (DPDPA) now forms the bedrock of this assessment, anchoring our approach while navigating the complexities of European (GDPR) and Californian (CCPA) frameworks. This comparative analysis highlights key considerations for privacy professionals engaged in cross-border M&A, focusing on where the DPDPA aligns with, diverges from, or remains silent compared to its international counterparts.
Navigating Data Transfer Complexities in M&A
Cross-border data transfers are often the most intricate aspect of privacy due diligence in M&A. The DPDPA, under Section 16, adopts a whitelist approach, permitting the transfer of personal data outside India to “such countries or territories outside India as may be notified by the Central Government.” For an acquiring entity, verifying the target’s compliance with this evolving list is paramount. If data is transferred to a non-notified jurisdiction, the acquiring entity must assess the feasibility and cost of remediation, potentially involving data localization or re-architecting data flows.
In stark contrast, the GDPR’s Chapter V (Articles 44-50) presents a far more granular and demanding framework. Transfers to third countries require an adequacy decision from the European Commission, or appropriate safeguards such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), along with supplementary measures to ensure data protection equivalent to EU standards (a key post-Schrems II requirement). Due diligence under GDPR therefore involves a deep dive into the legal basis for each international transfer, the specific safeguards implemented, and the ongoing assessment of recipient country laws. The DPDPA’s “notified jurisdictions” model is potentially stricter if India’s list is limited, but it offers a simpler, clearer (though less flexible) mechanism than GDPR’s multi-layered approach. The CCPA, by contrast, does not impose specific cross-border transfer mechanisms; its focus remains on the rights of California consumers irrespective of data location, making it largely silent on this specific aspect of M&A diligence.
Consent, Lawful Basis, and Data Minimisation
The DPDPA places significant emphasis on consent, requiring it to be “free, specific, informed, unconditional and an unambiguous indication” (Section 6). The recent Digital Personal Data Protection (Removal of Difficulties) Order, 2026, has further clarified aspects of consent records and audit requirements, making verification of the target’s consent management system a critical part of due diligence. The DPDPA also allows for “legitimate uses” (Section 7) as an alternative basis for processing, which requires careful assessment during M&A to ensure the target’s reliance on such grounds is justifiable.
GDPR (Articles 6 and 7) similarly demands explicit and verifiable consent for certain processing activities, but it also provides a broader array of lawful bases (e.g., contract necessity, legal obligation, legitimate interests) that due diligence must meticulously verify. The GDPR’s principle of data minimisation (Article 5(1)(c)) is also more explicitly articulated and enforced, requiring data to be “adequate, relevant and limited to what is necessary.” While DPDPA implies data minimisation through its purpose limitation principle (Section 6(1)), GDPR is often seen as more prescriptive here. The CCPA (as amended by CPRA) focuses on the right to opt-out of the “sale” or “sharing” of personal information and requires specific consent for sensitive personal information. Due diligence for CCPA primarily involves assessing the target’s mechanisms for honoring opt-out requests and its classification of data for sale/sharing purposes, rather than a comprehensive lawful basis assessment for all processing.
Accountability, Governance, and Security Posture
The DPDPA mandates Data Fiduciaries to implement “reasonable security safeguards” (Section 8(5)) and to notify the Data Protection Board of India and affected Data Principals in the event of a personal data breach (Section 17). For Significant Data Fiduciaries (SDFs), the obligations are heightened, including the appointment of a Data Protection Officer (DPO), undertaking Data Protection Impact Assessments (DPIAs), and conducting regular data audits (Section 10). M&A due diligence must identify if the target qualifies as an SDF and assess its compliance with these additional requirements. Furthermore, RBI guidelines on data localization for payment system data remain a critical check for financial sector targets.
GDPR sets a high bar for accountability (Article 24), requiring controllers to demonstrate compliance. This translates into extensive documentation requirements, including records of processing activities (Article 30), DPIAs (Article 35), and the appointment of DPOs (Article 37). Due diligence under GDPR is thus heavily focused on reviewing these internal governance documents and processes. GDPR’s breach notification period (72 hours to the supervisory authority, Article 33) is generally stricter than DPDPA’s, which does not specify a timeline but implies prompt notification. The CCPA (CPRA) requires businesses to implement reasonable security procedures and practices, but it does not mandate DPOs or DPIAs. Its primary enforcement mechanism for security failures is through statutory damages for breaches of unencrypted/unredacted personal information, shifting due diligence focus towards assessing the target’s cybersecurity incident response and historical breach exposure.
Practical Takeaway
For Indian businesses, General Counsels, and DPOs involved in M&A, an integrated approach to privacy due diligence is indispensable. Start with a robust DPDPA-centric framework, ensuring meticulous review of consent records, security safeguards, and cross-border data transfer mechanisms against the “notified jurisdictions” list. Layer on GDPR requirements for EU-facing targets, scrutinizing lawful bases, Article 30 records, and the complex web of Chapter V transfer mechanisms. For US-based targets, specifically assess CCPA compliance regarding consumer rights, opt-out mechanisms, and the classification of data “sale” or “sharing.” Proactive data mapping, comprehensive vendor assessments, and robust contractual protections are not just best practices but essential safeguards in today’s multi-jurisdictional privacy landscape.