I. Introduction
M&A due diligence has historically been a document centric
exercise. Data rooms traditionally functioned as repositories of
contracts, licences, financial statements, and compliance records,
with personal data appearing as incidentally embedded within those
documents. The implicit assumption was that personal data formed
part of the business assets and could be disclosed, transferred,
and integrated without significant legal constraints.
The enactment of the Digital Personal Data Protection Act, 2023
("DPDP Act") and the Digital Personal
Data Protection Rules, 2025 (collectively referred to as
"DPDPA") fundamentally changes this
approach. With full enforcement of DPDPA, expected in May 2027
("DPDPA Regime"), personal data will no
longer be a routine operational by-product; it will become a
regulated legal subject governed by consent, purpose limitation,
storage limitation, and fiduciary obligations.
