When You Acquire a Company,
You Acquire Its Data Liabilities
Under DPDPA 2023, acquiring companies inherit data protection obligations of the target. Non-compliant consent mechanisms, security gaps, and unreported breaches become the acquirer's responsibility. The Data Protection Board can impose penalties up to ₹250 Crore.
The Marriott-Starwood Case
A precedent for M&A data liability
In 2016, Marriott acquired Starwood Hotels for $13.6 billion. Undiscovered during due diligence: a breach ongoing since 2014 affecting 339 million guest records. The breach remained undetected until September 2018.
UK ICO fined Marriott £18.4 million for failing to implement adequate security measures post-acquisition. The fine was reduced from an initial £99 million notice, but established that acquirers bear responsibility for inherited data security failures.
Under DPDPA Section 8(5), Data Fiduciaries must implement reasonable security safeguards. Section 8(6) requires breach notification to the Data Protection Board and affected individuals.
Estimated Liability
Breakdown
| Variable | Value | Basis |
|---|---|---|
| Transaction (A) | ₹500 Cr | Consideration |
| Risk Score (B) | 60% | Assessment |
| Sector (C) | 1.2× | Sensitivity |
| Base Factor (D) | 0.5 | Standard |
| Raw | ₹180 Cr | A×B×C×D |
| Final | ₹150 Cr | Capped ₹250 Cr |
Five-Layer Liability Assessment
Consent Archaeology
Verify consent validity under DPDPA Section 6 requirements
Flow Cartography
Map data movement across systems and processors
Retention Analysis
Identify data held beyond purpose under Section 8(7)
Processor Audit
Assess Data Processor compliance per Section 8(2)
Breach Detection
Identify unreported incidents per Section 8(6)
DPDPA Statutory Framework
Section 8(5) — Security Safeguards
Data Fiduciaries must implement reasonable security safeguards. Failure attracts penalty up to ₹250 Crore.
Section 8(6) — Breach Notification
Mandatory notification to Data Protection Board and affected individuals. Penalty up to ₹200 Crore for non-compliance.
Assess Acquisition Risk
Data protection gaps in target companies create liability exposure. Pre-closing assessment identifies risks for negotiation and structuring.