Introduction
Mergers and acquisitions expose buyers and sellers to cybersecurity and data protection risks that can affect value, operations and legal liability. This guide provides a practical, repeatable checklist to integrate technical and privacy controls into the due diligence process.
Who should use this
- Legal teams and M&A advisors
- Finance and corporate development
- CISOs and IT leaders
- Data Protection Officers (DPOs) and privacy consultants
Due diligence objectives
- Verify the target's security posture
- Identify regulatory liabilities (GDPR, NIS2, DORA, AI Act, Cyber Resilience Act and national implementations)
- Assess exposure to incidents, litigation and contract breaches
- Define remediation plans and allocate risk contractually
Operational checklist (documents and evidence)
- Governance and documentation
- Records of processing activities (RoPA)
- Security and data protection policies, incident response plan
- Appointed roles: DPO, security owners, incident management team
- Internal audit reports and compliance reviews
Request: copy of RoPA, recent policy versions, audit minutes.
- Asset inventory and architecture
- Asset inventory (servers, endpoints, cloud, applications) and network diagrams
- List of critical third parties and service contracts (cloud, MSPs)
- Software bill of materials (SBOM) or component inventory where available
Evidence: exportable inventories, architecture diagrams, service agreements with SLAs.
- Technical controls and vulnerability management
- Recent penetration test and vulnerability assessment reports
- Patch management policies and evidence of patch cycles
- Hardening, encryption for data at-rest/in-transit, key management
- Identity & Access Management: MFA, privileged access controls, orphan account management
Request: pen test reports, remediation timelines, relevant security configurations.
- Backup, continuity and resilience
- Backup and restore policies and documented recovery tests
- Business continuity and disaster recovery plans
- Recent resilience exercises or evidence of DR testing
Look for proof of restore tests and declared RTO/RPO objectives.
- Incident response, logging and forensic readiness
- Incident response plan and playbooks for data breaches
- Procedures for notification to authorities and data subjects (GDPR breach reporting)
- Log retention and integrity for forensic analysis
Request past incident reports, post-mortem analyses and corrective actions.
- Data protection and privacy
- Data Protection Impact Assessments (DPIAs) for high-risk processing
- Data Processing Agreements (DPAs) with processors and contractual safeguards
- Data minimization, retention and deletion policies
- Handling of data subject rights requests (access, erasure, objection)
Documents: DPIAs, DPAs, sample subject request logs.
- Regulatory and compliance mapping
- Mapping of applicable obligations (GDPR, NIS2, DORA for financial entities, AI Act for classified AI systems, Cyber Resilience Act for digital products)
- Ongoing proceedings or notifications with supervisory authorities
- Relevant certifications (ISO 27001, SOC 2) and third-party audit reports
Verify formal notices, inspection records and remediation plans.
- Contracts, licenses and IP
- Source code ownership, IP transfer clauses
- Software licensing and open-source compliance
- Contract clauses addressing liability for breaches and cost-sharing of remediation
Check license inventories, IP transfer agreements and source code escrow arrangements.
- Third parties and supply chain risk
- Vendor risk assessments for subcontractors, cloud providers and managed service providers
- Vendor onboarding procedures, audit rights and penalties for non-compliance
Request list of critical vendors and recent vendor risk reports.
- Finance and insurance
- Estimated remediation costs post-closing
- Cyber insurance coverage, exclusions and limits
- Past claims and incident history
Evidence: policy documents, claims records and insurer correspondence.
Risk assessment and scoring
Build a risk matrix combining likelihood (low/medium/high) and impact (low/medium/high). Classify issues as:
- Critical: require pre-closing remediation or purchase price adjustment
- High: binding remediation plan with milestones in the SPA
- Medium: specific reps & warranties and escrow protections
- Low: post-closing recommendations
Recommended contractual clauses
- Specific representations and warranties on security, incidents and compliance
- Indemnities, escrow mechanisms and liability caps linked to remediation costs
- Right to audit post-closing and integration commitments
Integration and remediation plan
Create a post-closing playbook with priorities, owners, timelines and budgets. Focus on:
- Remediating critical vulnerabilities
- Hardening access controls and enabling MFA
- Aligning privacy policies and completing DPIAs
- Reviewing and renegotiating critical supplier contracts
Quick action checklist
- Obtain RoPA and DPIAs
- Request pen test reports and remediation POCs
- Verify incident response plan and log retention
- Review cyber insurance and past claims
- Insert contractual R&W and escrow clauses
Conclusion
A structured cyber and privacy due diligence reduces uncertainty and protects deal value. Early collaboration between legal, financial and technical teams and translating findings into contractual and operational measures is the most effective approach to closing a secure transaction.
