No Data, No Deal? The DPDP Act’s Impact On Indian M&A

Introduction

The Digital Personal Data Protection Act, 2023 (‘DPDP Act’) has altered how mergers and acquisitions are evaluated in India. What was once a routine ‘IT diligence’ item has now become a central driver of deal risk, valuation, and even deal viability in some cases.

In every merger and acquisition (‘M&A’) transaction, there is exchange of personal information belonging to customers, employees, vendors, and other stakeholders. This exchange is integral to the transaction and starts as early as the stage where the buyer or targets are being identified and extends until the deal closes- or sometimes, even post-closing. For instance, during due diligence, a buyer who evaluates an e-commerce company may seek access to customer databases to assess repeat purchase behavior, geographic spread, and marketing effectiveness. Under the DPDP Act, sharing such identifiable customer data without valid consent or anonymization could expose the seller to compliance risks even before the