Due diligence
Purchase agreement



Canada has seen a recent peak in M&A deal activity (for further details please see "2022: will Canada's M&A surge continue?"). Privacy and cyber risks that go undiscovered in the M&A transaction process can result in potentially significant costs and liabilities post-closing. Further, the M&A transaction process itself can give rise to privacy and cyber risks (for further details please see "Managing cyber risks in M&A transactions").

Therefore, organisations should take steps throughout the M&A transaction process to identify potential and existing privacy and cyber risks and to avoid creating new ones.

This article provides three checklists for Canadian organisations when handling privacy risks in M&A.

Due diligence

  • Engage in privacy and cyber-specific due diligence of the target.
  • Understand the target's collection and use of personal information, including the data flow through the target's organisation.
  • Understand the privacy laws that apply to the target's personal information handling practices and consider whether the target has complied with specific obligations under those privacy laws.

Purchase agreement

  • Ensure the purchase agreement addresses privacy and cyber risks identified in due diligence, including appropriate representations and warranties.
  • Include indemnities, holdbacks and insurance obligations that address privacy and cyber risks (where appropriate).
  • Ensure the purchase agreement contains appropriate provisions that comply with applicable privacy laws to permit the sharing of personal information post-closing.


  • Implement policies and procedures to transfer personal information to the purchaser post-closing.
  • Notify individuals of the disclosure of their personal information during the M&A transaction process as required by applicable privacy laws.
  • Remediate the privacy and cyber risks identified in due diligence.

For further information on this topic please contact Sepideh Alavi, Katherine M Stanger or Danielle Windt at Borden Ladner Gervais LLP by telephone (+1 416 367 6000) or email ([email protected], [email protected] or [email protected]). The Borden Ladner Gervais LLP website can be accessed at