Three essential checklists for handling privacy risks in M&A

Introduction​
Due diligence
Purchase agreement
Post-closing

Introduction

Canada has seen a recent peak in M&A deal activity (for further details please see "2022: will Canada's M&A surge continue?"). Privacy and cyber risks that go undiscovered in the M&A transaction process can result in potentially significant costs and liabilities post-closing. Further, the M&A transaction process itself can give rise to privacy and cyber risks (for further details please see "Managing cyber risks in M&A transactions").

Therefore, organisations should take steps throughout the M&A transaction process to identify potential and existing privacy and cyber risks and to avoid creating new ones.

This article provides three checklists for Canadian organisations when handling privacy risks in M&A.

Due diligence

• Engage in privacy and cyber-specific due diligence of the target.

• Understand the target's collection and use of personal information, including the data flow through the target's organisation.

• Understand the privacy laws that apply to the target's personal information handling practices and consider whether the target has complied with specific obligations under those privacy laws.

Purchase agreement

• Ensure the purchase agreement addresses privacy and cyber risks identified in due diligence, including appropriate representations and warranties.

• Include indemnities, holdbacks and insurance obligations that address privacy and cyber risks (where appropriate).

• Ensure the purchase agreement contains appropriate provisions that comply with applicable privacy laws to permit the sharing of personal information post-closing.

Post-closing

• Implement policies and procedures to transfer personal information to the purchaser post-closing.

• Notify individuals of the disclosure of their personal information during the M&A transaction process as required by applicable privacy laws.

• Remediate the privacy and cyber risks identified in due diligence.

For further information on this topic please contact Sepideh Alavi, Katherine M Stanger or Danielle Windt at Borden Ladner Gervais LLP by telephone (+1 416 367 6000) or email ([email protected], [email protected] or [email protected]). The Borden Ladner Gervais LLP website can be accessed at www.blg.com.