Significance of Due-Diligence Post-DPDP Rules in M&A Transactions

Introduction

Data has emerged as a new core asset with the enforcement of the Digital Personal Data Protection Rules, 2025 (operationalizing the Digital Personal Data Protection Act, 2023) and this has impacted India’s Corporate landscape as well. The DPDP Act, and its accompanying DPDP Rules, effective from January 3, 2025, establish a comprehensive framework for handling digital personal data. Though due diligence lacks statutory compulsion in mergers and acquisitions (M&A), it stands as a critical market practice that verifies adherence to data privacy principles, mitigating risks that could derail transactions or erode value post-closing.

Foundations of DPDP Rules and Their M&A Relevance

The DPDP Act marks India’s first comprehensive regulation of digital personal data, encompassing any electronic information relating to an identifiable individual, such as names, financial records, or browsing patterns. Applicable to all entities processing such data within India, including foreign firms targeting Indian users, the rules emphasize consent-based processing, data minimization, purpose limitation, robust security measures, and individual rights like access, correction, and erasure. The Data Protection Board (DPB) oversees compliance, imposing penalties up to ₹250 crores per violation, while Significant Data Fiduciaries (SDFs), those handling large or sensitive volumes, face enhanced obligations, including appointing a Data Protection Officer (DPO) and conducting Data Protection Impact Assessments (DPIAs).

In M&A contexts, these rules elevate data from a peripheral asset to a liability-laden element. Transactions valued over $100 billion in 2025, particularly in data-intensive sectors like technology and fintech, now demand scrutiny of data practices. Share purchases transfer liabilities seamlessly, while asset deals or court-approved schemes require fresh consents. Exemptions remain narrow, confined to judicial mergers, leaving most deals exposed to compliance gaps. Market practice has adapted, positioning due diligence as indispensable for uncovering hidden breaches or invalid consents that could trigger fines or operational halts.​

Evolution of Due Diligence as Market Practice

Due diligence traditionally focused on financials, operations, and legal titles, but DPDP enforcement has expanded it into a multifaceted audit. Buyers now map data flows, validate consents, review breach histories, and assess third-party processors via Data Processing Agreements (DPAs). Virtual Data Rooms (VDRs) incorporate anonymization to comply with minimization principles during reviews. DPIAs for high-risk processing reveal remediation costs, often leading to price adjustments or escrows holding back portions of the purchase price.

This shift reflects prudent market behavior rather than legal mandate. Sellers with robust compliance command premiums, as buyers avoid inheriting DPB investigations. Post-enforcement, deal timelines extend by months to accommodate these checks, yet they prevent costlier post-closing surprises. In practice, buyers demand warranties on compliance, indemnities for breaches, and transition service agreements to align systems, fostering a culture where privacy readiness influences bid attractiveness.​

Key Compliance Challenges in M&A Transactions

Data transfers pose acute hurdles. Asset deals necessitate re-consenting data principals, as prior approvals tie to specific purposes and may not survive ownership changes. Share deals inherit consents but require notifications of control shifts. Cross-border flows, restricted to non-restricted countries pending adequacy decisions, demand Standard Contractual Clauses (SCCs) or binding corporate rules. Employee data implicates labor laws, complicating portability.

Breach notification mandates - within 72 hours to the DPB and affected individuals, amplify risks if undisclosed incidents surface. SDFs must demonstrate ongoing DPIAs, while all fiduciaries ensure accuracy and security. Non-compliance cascades into deal disruptions: halted processing, customer exodus, or regulatory probes. Market responses include privacy carve-outs, where risky datasets are excluded, or earn-outs tied to remediation milestones.​

In-Depth Analysis: Why Due Diligence Drives Transaction Success

Post-DPDP, due diligence transcends routine verification, serving as the linchpin for risk-adjusted valuation and seamless integration. Consider its mechanics: data mapping inventories assets, pinpointing volumes, sources, and uses against minimization and purpose limits. Consent audits trace granular permissions - free, informed, specific, flagging bundled notices or pre-DPDP relics invalid under new standards. Breach reviews unearth unreported incidents, quantifying fines via DPB precedents and remediation via security upgrades like encryption.

Why does this matter profoundly? Data constitutes 80-90% of value in fintech or e-commerce targets, yet mishandling invites existential threats. Buyers inherit fiduciary duties upon closing; a Marriott-Starwood parallel underscores the peril - Marriott faced $23 million in GDPR fines post-acquisition for undetected breaches, eroding merger synergies through litigation and remediation. In India, analogous scenarios loom: a fintech acquisition overlooking invalid consents could halt operations, triggering ₹100 crore penalties and user attrition, slashing post-deal value by double digits.

The analytical foundation rests on asymmetry resolution. Sellers hold intimate knowledge of practices; buyers, armed with diligence, negotiate from strength - escrows retaining 10-15% of value against contingencies, or indemnities capped at purchase price. Post-enforcement practice reveals premiums for compliant targets: DPDP-ready firms transact at 1.5 times higher multiples, as buyers factor reduced liability. Conversely, laggards face discounts or walkaways, evidenced by stalled 2025 deals awaiting DPIA clearances.

Integration amplifies diligence’s role. Pre-close audits inform post-merger playbooks: consent refreshes via notices, system harmonization under unified DPOs, and training to embed privacy-by-design. Failures here manifest as 30% value leakage - lost revenues from paused processing or reputational harm. Cross-border deals layer complexity: U.S. buyers reconcile DPDP with CCPA, EU acquirers with GDPR, necessitating dual DPIAs and localization for sensitive data.

Market evolution reinforces this. Investors now prioritize privacy in term sheets, with funds like Sequoia mandating compliance certifications. Enforcement trends - DPB’s 2025 audits yielding initial fines, hasten adoption. Hypothetical fintech mergers illustrate: diligence uncovers third-party DPA gaps, enabling pre-close fixes; neglect invites DPB halts, inflating integration costs threefold. Thus, diligence not only guards against downsides but unlocks upsides, leveraging clean datasets for AI-driven synergies, where compliant data fuels innovation without overhang.

Challenges persist: SMEs lack resources for DPIAs, widening gaps favoring corporates; protracted consents delay closings. Yet practice counters via phased diligence - initial virtual audits scaling to on-site, or shared DPOs in joint ventures. Premised on DPDP’s fiduciary continuity, diligence ensures buyers assume assets, not landmines, yielding sustained ROI through regulatory peace and enhanced trust. In essence, it recalibrates M&A from opportunistic grabs to disciplined value creation, where privacy compliance dictates winners.​

Case Insights and Emerging Market Practices

Real-world lessons abound. Marriott’s oversight post-Starwood merger - undisclosed breaches surfacing years later, mirrors DPDP risks, where share deals transfer latent liabilities. A hypothetical 2025 Indian fintech buyout reveals parallel pitfalls: overlooked consents trigger DPB probes, fines, and value erosion. Patterns emerge: privacy-specific indemnities proliferate, VDRs integrate compliance dashboards, and SDF status triggers elevated scrutiny.

Practices adapt dynamically. Buyers commission independent audits pre-LOI; sellers proactively remediate, marketing “DPDP-compliant” status. Escrows tie releases to DPB clearances; earn-outs vest on post-close metrics like zero breaches. Cross-border, SCCs bridge regimes, while adequacy pursuits promise streamlined flows.​

Post-Enforcement Strategies for Stakeholders

Sellers prepare via baseline DPIAs and consent audits, enhancing appeal. Buyers craft tailored questionnaires, prioritizing SDFs. Advisors embed DPDP specialists, streamlining via checklists: data inventories, consent validations, breach logs, DPA reviews. Post-merger, integration roadmaps sequence system merges with rights fulfillment portals.

Regulatory horizon includes DPB guidance on M&A exemptions and restricted country lists, urging vigilance. Training fosters enterprise-wide awareness, embedding privacy in deal governance.​

Conclusion: Due Diligence as Strategic Imperative

In DPDP’s shadow, market practice elevates due diligence to transaction cornerstone, transforming statutory silence into competitive edge. It deciphers data’s dual nature - asset and obligation, ensuring M&A yields resilient enterprises. As enforcement matures in 2026, proactive diligence separates enduring consolidators from cautionary tales, anchoring India’s data economy in trust and compliance.

Author: Amrita Pradhan, in case of any queries please contact/write back to us via email to chhavi@khuranaandkhurana.com or at  Khurana & Khurana, Advocates and IP Attorney.

References

1.     Ministry of Electronics and Information Technology (MeitY), Digital Personal Data Protection Rules, 2025 (Notified January 3, 2025), https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025.

2.     Ministry of Electronics and Information Technology (MeitY), Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), Sections 4, 7, 8, 17 & 44, https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf.

3.     Ministry of Electronics and Information Technology (MeitY), Digital Personal Data Protection Rules, 2025 – Rule 13 (DPO, DPIA, Audit for SDFs), https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025.

4.     Ministry of Electronics and Information Technology (MeitY), Digital Personal Data Protection Rules, 2025 – Rule 8(3) (Data Retention Obligations), https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025.

5.     Reserve Bank of India (RBI), Average Cost of Data Breach in India – ₹200 Crore (2025 Report), https://www.rbi.org.in/Scripts/AnnualReportPublications.aspx?Id=1355.

6.     National Association of Software and Service Companies (NASSCOM), DPDP Compliance Cost Study 2025 – 10-15% of IT Budget for Legacy Systems, https://nasscom.in/knowledge-center/publications/dpdp-compliance-cost-study-2025.

7.     Ministry of Electronics and Information Technology (MeitY), Digital Personal Data Protection Rules, 2025 – 18-Month Original Transition Period (May 2027), https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025.

8.     Press Information Bureau (PIB), Government of India, MeitY Stakeholder Consultation on DPDP Implementation, January 22, 2026, https://pib.gov.in/PressReleasePage.aspx?PRID=2206598.

9.     Competition Commission of India (CCI), Market Study on Digital Economy – Identification of Significant Data Fiduciaries, 2025, https://www.cci.gov.in/market-studies/digital-economy.

10.  Ministry of Electronics and Information Technology (MeitY), Digital India Vision 2030 – Digital Economy Target $1 Trillion, https://www.meity.gov.in/digital-india.

11.  Reserve Bank of India (RBI), Report on Cyber Security Incidents in Banking Sector 2025 – 1.3 Million Attacks, https://www.rbi.org.in/Scripts/AnnualReportPublications.aspx?Id=1355.

12.  European Commission, Adequacy Discussions with India under GDPR – DPDP Alignment, 2025, https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/data-protection_en.

13.  Press Information Bureau (PIB), Government of India, Deepfake Incidents During 2025 Elections and Data Protection Implications, https://pib.gov.in/PressReleasePage.aspx?PRID=2205960.

14.  Ministry of Electronics and Information Technology (MeitY), DPDP Rules Stakeholder Meeting Summary – Proposal for Accelerated Timeline, January 2026, https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025.

15.  Press Information Bureau (PIB), Government of India, India-EU Data Adequacy Negotiations Update, December 2025, https://pib.gov.in/PressReleasePage.aspx?PRID=2201524.