Deal teams tend to think of a data room as a commercial and legal space: contracts, financial statements, permits, board minutes. Privacy regulators see something else. Employee lists with salaries and dates of birth. Customer contracts with named contacts. Pension records, medical leave files, background checks, CCTV policies. For a regulator, a data room in a company sale is a large, organized disclosure of personal data to people who are not the employer and may be in another country.
This guide is a practical overview, not legal advice. It covers the laws a data room most often meets, what they have in common, and how to set up a room so that the privacy questions have good answers. For country detail, our regions hub has guides to sixteen jurisdictions.
What personal data ends up in a data room?
More than most sellers expect. A typical company sale room contains:
| Folder | Typical personal data | Sensitivity |
|---|---|---|
| HR and employment | Names, roles, salaries, bonuses, contracts, performance and disciplinary records | High |
| Pensions and benefits | Member lists, contributions, health benefit claims | High, sometimes special category |
| Commercial | Customer and supplier contacts, signatories, account managers | Medium |
| Litigation and compliance | Claimants, complainants, whistleblower reports, investigation files | High |
| IT and security | User lists, access logs, incident reports | Medium |
| Corporate | Directors’ and shareholders’ details, cap table | Medium |
Health data, criminal records and union membership are treated as special categories under many laws, with stricter conditions. They are rarely needed by bidders in identifiable form.
How do the main privacy laws treat due diligence?
Eight privacy regimes that reach deal data
No deal exception; legitimate interests
No deal exception; legitimate interests
M&A transfer carve-out from "sale"
Business transaction exception, s. 7.2
Business asset transaction exception
Court or tribunal schemes only
No deal exception; APP 8 for overseas
DIFC and ADGM have their own laws
| Law | Where it applies | Basis for disclosure in diligence | Transfer rules to note |
|---|---|---|---|
| GDPR | EU and EEA | Usually legitimate interests, with a balancing test | Adequacy decision or a mechanism such as standard contractual clauses |
| UK GDPR and Data Protection Act 2018 | United Kingdom | Usually legitimate interests | UK adequacy regulations, the IDTA or the UK addendum to SCCs |
| CCPA, as amended by the CPRA | California | Notice and contracts; M&A transfers have a specific carve-out from “sale” | No transfer regime, but contract terms with recipients matter |
| PIPEDA | Canada (federal private sector) | Business transaction exception in section 7.2, with a written agreement | Accountability for information sent to third parties |
| PDPA 2012 | Singapore | Business asset transaction exception, with conditions | Transfer limitation obligation |
| DPDP Act 2023 | India | Consent or a defined legitimate use; exemption only for court or tribunal approved schemes | Transfers allowed except to restricted countries |
| Privacy Act 1988 | Australia | APP 6 limits on use and disclosure; no general deal exception | APP 8 and section 16C accountability for overseas recipients |
| Federal PDPL | UAE onshore | Consent or a listed exception; DIFC and ADGM have separate laws | Transfer rules depend on the regime |
A few points deserve more detail.
GDPR and UK GDPR
The GDPR has no exception written for M&A. Sellers usually rely on legitimate interests: the seller’s interest in selling and the buyer’s in evaluating the business. That basis requires a balancing test, and the balance favours disclosure only when the data is necessary and protected. Disclosing every employee’s salary history to ten bidders in round one would be hard to defend; disclosing salary bands to ten bidders and named data to one preferred bidder under a confidentiality agreement is far easier.
The GDPR also requires notice to individuals, security appropriate to the risk, and a breach report to the supervisory authority within 72 hours where required. The UK follows the same model under the UK GDPR and the Data Protection Act 2018, supervised by the Information Commissioner’s Office. Our United Kingdom guide covers the local detail.
California’s CCPA
The CCPA, as amended by the CPRA, now covers employee and business-contact data as well as consumer data. Its definition of “sale” excludes the transfer of personal information as an asset in a merger or acquisition where the acquirer assumes control, subject to conditions on later use. That carve-out is about the completed transfer; it does not remove the need for sensible limits during diligence. The California Attorney General’s CCPA page is the starting point. Other US states have their own privacy acts, and sector laws such as HIPAA apply to health information held by covered entities. See our United States guide.
Canada and Singapore
These are the two regimes in this overview with a clear transaction exception. PIPEDA’s section 7.2 allows disclosure without consent for a prospective business transaction if the information is necessary and the parties agree to use it only for that purpose, protect it, and return or destroy it if the deal does not proceed. Singapore’s PDPA has a business asset transaction exception built on similar ideas. In both, the written agreement and the limits on scope are what make the exception work. Our Canada and Singapore guides explain the conditions.
India and Australia
India’s Digital Personal Data Protection Act 2023, with its 2025 rules, is consent-centred. It has an exemption for processing needed in a scheme of compromise, arrangement, merger or amalgamation approved by a court or tribunal, but ordinary private sales are not obviously covered. Our India guide covers the phase-in.
Australia’s Privacy Act 1988 has no general deal exception. Disclosures must fit the Australian Privacy Principles, and under APP 8 and section 16C an Australian organization that discloses to an overseas recipient can be accountable for what that recipient does with the data. See the Australia guide.
What do all these laws have in common?
Despite different wording, the duties a seller faces in a data room converge on five ideas:
- Purpose. Use the data only to evaluate and complete the transaction.
- Minimization. Disclose only what each party needs at each stage.
- Security. Protect the data with appropriate controls.
- Transfers. Respect the rules for sending or exposing data across borders.
- Retention. Return or delete data when it is no longer needed, especially if the deal fails.
A room that is set up around these five ideas will satisfy most regimes in most deals, with local advice filling the gaps.
The room is not the basis
A data room’s security controls help you meet the duty to protect data and to show accountability. They do not decide whether you were allowed to disclose the data in the first place. That question is for your lawyers, before upload.
How to minimize personal data before upload
Minimization does more to reduce privacy risk than any feature. It also tends to reduce leak risk and makes the room easier for bidders to read.
Map personal data by folder
Before upload, tag each folder with the categories of personal data it contains and where the individuals are located.
Aggregate where you can
Replace employee lists with headcount by role, location and salary band. Bidders in early rounds need the shape of the workforce, not names.
Pseudonymize what must stay granular
Replace names with employee numbers in contracts, disputes and benefit data, and keep the key outside the room.
Redact special category data
Remove health, criminal record and similar data unless a specific diligence question requires it and counsel agrees.
Stage named data behind a restricted folder
Hold identifiable records in a folder opened only to the preferred bidder, under confidentiality terms that limit use and require deletion.
Set retention for the archive
Decide how long the closing archive will be kept and why, and make sure losing bidders confirm deletion of what they downloaded.
Redaction can be done before upload or inside the room. Seven of the 16 providers in our directory list built-in redaction, among them iDeals, Datasite, Intralinks, Firmex and Drooms. If you redact inside the room, test that the redaction is permanent in downloaded copies.
Which data room features support privacy compliance?
Features that help you demonstrate purpose limitation, security and accountability:
- Granular permissions by group and folder, so personal data is visible only to the bidders and advisers who need it.
- View-only and document rights controls, which stop or limit downloads of sensitive files.
- Dynamic watermarking, which ties every view and print to an identifiable user.
- Audit trail, which shows exactly who accessed personal data and when; essential evidence if a regulator asks.
- Two-factor login, which protects against account takeover; see our guide to two-factor authentication in data rooms.
- Hosting region choice and a clear subprocessor list, for transfer assessments.
- Click-through terms at first login that restate the confidentiality and use limits; see our guide to click-through NDAs.
Our provider directory shows these features for each provider. Full-featured rooms such as Ellty, iDeals and Datasite include permissions, watermarking, audit trail and two-factor login; check certifications and hosting options against your own requirements.
What about competitively sensitive information?
Privacy law is not the only reason to restrict data. When the buyer is a competitor, competition law limits the exchange of commercially sensitive information, such as customer-level pricing, before closing. The usual tool is a clean team folder accessible only to a small group of the buyer’s advisers or ring-fenced staff. Personal data and competitively sensitive data often overlap, for example in key-customer contracts, so the same restricted structure can serve both purposes. Our due diligence hub describes how clean teams are set up.
What should you do if a privacy incident happens in the room?
Act as you would for any breach:
- Contain. Suspend the affected account or group immediately; revoke document rights where the room allows.
- Assess. Use the audit trail to see exactly which documents were accessed or downloaded and by whom.
- Notify. Check notification duties in each relevant jurisdiction; under the GDPR, the 72-hour clock for the supervisory authority runs from awareness of a notifiable breach.
- Record. Document the incident and the response, whatever the outcome.
Ask your provider, before the deal, how quickly it will notify you of an incident on its side and what logs it can provide.
How does privacy law affect the end of the deal?
At closing, the buyer usually becomes responsible for employee and customer data as the new owner, under its own notices. Losing bidders must return or destroy what they received, and the seller should obtain written confirmation. The seller’s own archive of the room should have a stated retention period that reflects warranty and limitation periods, not “forever”. Our guide to how long a data room stays open covers the closing sequence.
Browse our country guides for the privacy rules and deal process in each jurisdiction.
Explore regionsFAQ
Does GDPR apply to due diligence?
Yes, whenever personal data of individuals covered by the GDPR is disclosed. Sellers typically rely on legitimate interests, must minimize the data shared, protect it and respect transfer rules for recipients outside the EEA.
Can I share employee data with bidders?
Usually only in limited form. Share aggregated or pseudonymized data in early rounds and identifiable records only with the preferred bidder under strict confidentiality terms. Some laws, such as Canada's PIPEDA, have a specific transaction exception with conditions.
Which privacy laws have a specific M&A exception?
Canada's PIPEDA (section 7.2) and Singapore's PDPA (business asset transactions) have clear exceptions with conditions. California's CCPA excludes M&A asset transfers from the definition of sale. The GDPR, UK GDPR and Australia's Privacy Act have no general deal exception.
Is a bidder viewing documents from abroad a data transfer?
Under the GDPR and many similar laws, giving remote access to personal data to a recipient in another country is treated as a transfer, so transfer rules apply.
Does using a certified data room make disclosure compliant?
No. Certifications and controls help with security and accountability, but the seller still needs a lawful basis for each disclosure and must limit what is shared.