Merger and acquisition activity is surging to the highest rates since the global financial downturn in 2008—before the advent of Big Data, headline-making data breaches and class action lawsuits asserting all sorts of alleged privacy violations. But as volumes of data and associated liabilities steadily rise every year, today’s M&A due diligence practices should not be simply a return to business as usual for acquiring entities.
In addition to traditional areas of due diligence inquiry, acquiring entities now should also focus on the information owned and controlled by the target entity. But it’s not just a list of the information that the acquirer needs. The acquirer also needs to know how the target governs that information, the risks and liabilities associated with the data, and the target’s past information governance practices. If these issues are not considered as a part of the deal process, it may be too late to make any changes once the deal is signed, presenting a scenario where the acquirer doesn’t get data it needs or acquires a host of problems it didn’t want and could have avoided
