DPDP in M&A and Investment Due Diligence

Introduction

A buyer of an Indian consumer business is often buying a database: customers, patients, learners or borrowers, and the permissions to use their data. From 13 May 2027, when most of the Digital Personal Data Protection Act, 2023 (the DPDP Act) commences, that database is an asset only to the extent it can lawfully be used, and a liability to the extent it was not lawfully built.

The Act bites at diligence, closing and integration. A data fiduciary decides why and how personal data is processed; a data principal is the person it is about. Trayambic's law-firm study covers data-room mechanics for advisers, and our startup whitepaper lists what venture investors ask; we cross-refer rather than repeat.

The legal position

Grounds. Personal data may be processed only on consent or a legitimate use in s.7 (s.4). The list is closed, with no legitimate-interests ground. Section 7(a) covers the "specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary".

The scheme exemption. Section 17(1)(e) disapplies Chapter II (except ss.8(1) and 8(5)), Chapter III and s.16 where processing is "necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies", or for a demerger, transfer of undertaking or division of companies, "approved by a court or tribunal or other authority competent to do so by any law for the time being in force". The National Company Law Tribunal (NCLT) sanctions schemes under ss.230 to 232 of the Companies Act, 2013, and its order can provide for transferring the undertaking and the employees (s.232(3)(a), (g)). Fast-track mergers under s.233 are confirmed by the Central Government, in our view an "authority competent to do so".

Disclosure duties. Data likely to be "disclosed to another Data Fiduciary" must be complete, accurate and consistent (s.8(3)). An access response must identify "all other Data Fiduciaries and Data Processors" the data was shared with (s.11(1)(b)). Where consent is the basis, the fiduciary must prove notice and consent (s.6(10)).

Analysis

Asset and liability

The asset is not the row count but the usable share of it: consents covering the buyer's plans (s.6(1) ties consent to the specified purpose), parental consents for children (s.9(1)) and models trained on lawfully sourced data.

The liability has three parts. Penalties are set by obligation: up to ₹250 crore for security safeguards, ₹200 crore for breach notice or children's duties, ₹150 crore for Significant Data Fiduciary (SDF) duties and ₹50 crore for the rest. Erasure under s.8(7) can force deletion of data the valuation assumed. And history survives: in Trayambic's view, s.43A IT Act claims for negligence before 13 May 2027 outlive the section's omission.

Does sharing customer data with a buyer need consent?

Trayambic's view, reading s.7 clause by clause: for identifiable customer data, yes.

• Section 7(a) covers the purpose for which she gave her data to this fiduciary. A sale of the business is not that purpose, and the bidder is not that fiduciary.
• Section 7(i) covers employment purposes. In our view diligence on staff is not one, though handing over records of employees who move with the business at closing arguably is.
• Sections 7(b) to (h) concern the State, court orders and emergencies. None fits.
• Section 17(1)(e) helps only for an approved scheme. As Trayambic's law-firm study notes, whether it reaches diligence before approval is uncertain, and an abandoned scheme never qualifies.

Asking thousands of customers to consent to a confidential deal is impractical, so share data that is not personal data, or much less of it. A bidder that receives named data decides its own purpose, evaluating the deal, so in our view it is a fiduciary for that copy, not the seller's processor. And because s.11(1)(b) requires the seller to identify the fiduciaries it shared data with, one customer's access request could reveal the bidders.

The data room

Build disclosure in three tiers.

1. 1.Aggregates for every bidder: counts by data category, consent coverage by purpose, share of children, vendor list, incident summary.
2. 2.Inspection, not export, for testing: the buyer's advisers sample consent records, notices and deletion logs inside the seller's systems by screen-share, with identifiers masked, and record what they saw.
3. 3.Named data only where the deal turns on individuals, such as key managers who are told, and only for a clean team: a few named people, often external advisers, who report to the buyer in aggregate.

The confidentiality agreement should carry data terms: use only to evaluate the deal, no onward sharing, Rule 6-grade security, incident alerts within hours, and return or destruction, with a certificate, when the deal closes or dies. Under s.8(3), check anything named for accuracy before it goes.

Diligence questions for targets

For a funding round, use the questions in Trayambic's startup whitepaper. For an acquisition, ask for evidence.

Warranties and indemnities

A warranty moves cost between the parties; it does not change whom the Data Protection Board holds responsible. DPDP warranties should state that:

• each processing activity has a recorded ground under s.4, and consent can be proved as s.6(10) requires;
• notices meet s.5 and Rule 3;
• no child's data is processed without verifiable parental consent, or used for tracking, behavioural monitoring or targeted advertising (s.9);
• every processor is engaged under a contract with Rule 6 security terms;
• every reportable cyber incident has been reported to CERT-In, and from 13 May 2027 every breach to the Board and affected people;
• there is no complaint, Board inquiry, voluntary undertaking or SDF designation, pending or threatened;
• training data for any model was lawfully sourced.

Known problems need a specific indemnity, a holdback or a pre-closing fix. Survival periods should outlast a Board inquiry (six months under Rule 19(9), extendable) and any appeal. Whether a contract can shift a DPDP penalty is untested in India, so in our view price the risk rather than rely on recovery.

Post-closing integration

The DPDP Act has no compatible-purpose test and no group exemption. Three rules follow.

1. 1.A share deal moves no data, but integration does. Sharing the target's customers with the buyer's other companies is disclosure to other fiduciaries and needs consent or, in our view, s.7(a) where the person herself asks for the joint service.
2. 2.New owner, new notice. After a scheme or business transfer, tell people who now holds their data, with the Rule 9 contact and grievance route. In our view a new fiduciary relying on consents the seller obtained should give its own notice, and seek fresh consent for any new purpose.
3. 3.Merge, then minimise. Deduplicate, erase what is no longer needed (s.8(7)) and recheck the s.10(1) factors: combined volume makes SDF designation more likely.

Investors in startups

Minority investors rarely need personal data. Information rights can be met with aggregates, board packs should keep customer-level data out, and a fund's platform team that wants portfolio data for cross-selling needs each company's ground for sharing it.

Practical implications

Worked example: a private equity fund buys a diagnostics chain

Facts and figures are illustrative. A fund agrees to buy 70% of a holding company whose two subsidiaries run 45 laboratories and a home-collection app, with about 30 lakh patient records. It plans to merge the subsidiaries by NCLT scheme and to link the chain with a hospital group it owns.

1. 1.Diligence. The room holds aggregates. Advisers test 60 consent records by screen-share and find the app bundles marketing consent with booking, which s.6(1) does not allow. Paediatric testing can rely on the Rule 12 exemption for clinical establishments, but that covers health services, not the marketing list the app built from children's reports. A 2025 ransomware attack was reported to CERT-In but not to patients; Rule 7 was not then in force, but in our view patients could still claim under s.43A.
2. 2.The agreement. DPDP warranties; a specific indemnity and holdback for the ransomware incident; pre-closing covenants to unbundle consent and purge the marketing list.
3. 3.Closing. A share purchase: the subsidiaries remain the fiduciaries, no data moves and s.17(1)(e) is irrelevant.
4. 4.The merger. Once the scheme is sanctioned, moving records and staff to the merged company is processing necessary for it; patients then receive a notice naming the new company.
5. 5.The hospital link. The chain and the hospital group are separate fiduciaries, so referral data is shared only on each patient's consent or at her request.
6. 6.SDF. Trayambic's hospitals study rates SDF likelihood Medium, with large chains the likeliest candidates; given the merged volumes, the fund commissions a voluntary impact assessment.

Deal checklist

Key takeaways

The DPDP Act gives deals one narrow exemption, for approved schemes, and none for share purchases, asset deals or investor diligence. Value data by what it can lawfully do, keep named data out of data rooms, turn findings into specific protection, and plan integration notices and consents before closing.

• Section 17(1)(e) covers processing necessary for schemes approved by a court, tribunal or competent authority; in our view it does not cover share purchases, contractual asset deals or investor diligence.
• On Trayambic's reading of s.7, no legitimate use fits showing identifiable customer data to a bidder, so data rooms should rely on aggregates, inspection and clean teams.
• A bidder that receives named data is, in our view, a fiduciary for that copy, and s.11(1)(b) could make the seller disclose it to an inquiring customer.
• Warranties should track the Act's own duties (grounds, notices, children, processors, incidents, Board proceedings); known problems belong in specific indemnities, holdbacks or pre-closing fixes, with survival beyond a Board inquiry.
• The Act has no group exemption or compatible-purpose test, so integration needs new notices and fresh consent for new purposes.