Mergers, acquisitions and closures.
WHAT HAPPENS TO PERSONAL DATA
It is an asset, and it transfers with the business.
WHAT THAT REQUIRES
A lawful basis Transparency with individuals Assessment during due diligence
WHAT DUE DILIGENCE SHOULD EXAMINE
What data the target holds Its lawful bases Its compliance record Any breaches Retention practices
WHY IT MATTERS TO A BUYER
You inherit the liabilities.
WHAT TO BE CAREFUL WITH DURING DILIGENCE
Sharing actual personal data before completion.
WHAT TO DO INSTEAD
Aggregate figures and samples that are anonymised.
WHAT TO TELL INDIVIDUALS
That the transfer has occurred, and what it means.
WHEN
Promptly after completion, or before if appropriate.
WHAT TO REVIEW AFTER ACQUISITION
Whether the acquired practices meet your standard.
WHAT TO DO ABOUT GAPS
Remediate, with a plan and a timeline.
WHAT TO CONSIDER
Whether the acquired data can lawfully be used for your purposes.
WHY
A basis for their processing may not extend to yours.
WHAT CLOSING A BUSINESS REQUIRES
Deciding what happens to data Deleting what is not required Retaining what the law requires, securely
WHAT TO NEVER DO
Abandon data on systems nobody maintains.
WHAT TO DOCUMENT
The decisions, and the deletion.
