© Copyright Acquisition International 2025 - All Rights Reserved.

Article Image - Cyber-Security in the M&A Process
Posted 22nd June 2016

Cyber-Security in the M&A Process

During an M&A deal process huge amounts of sensitive data is shared in the cyber-space between buyers, sellers and their respective advisors. Infringement of this data’s cyber-security could leave parties open to significant claims.

Mouse Scroll AnimationScroll to keep reading

Let us help promote your business to a wider following.

Cyber-Security in the M&A Process
Image

Cyber-Security in the M&A Process

During an M&A deal process huge amounts of sensitive data is shared in the cyber-space between buyers, sellers and their respective advisors. Infringement of this data’s cyber-security could leave parties open to significant claims. In addition to explicit contractual obligations which parties may impose upon each other in respect of data security, and regulatory duties imposed under legislation such as the Data Protection Act 1998 (DPA), both sellers and buyers (and any third party suppliers) will owe: (i) an equitable duty to individuals to preserve the confidentiality of their information, and (ii) a parallel duty through the tort of negligence to keep it secure.

How can parties be extra-vigilant to ensure that the security of the information being collated, reviewed and negotiated is not compromised or vulnerable to cyber-attack during the M&A process?

· Cyber-security policies and procedures should be carefully reviewed and updated by each party at the outset of the deal to ensure compliance with current best practice.

· Project names are a simple but effective security measure.  Especially in email traffic, which can be voluminous and rapid, project names and party pseudonyms (where allocated) should be carefully and consistently used.

· Confidentiality agreements should be cautiously drafted and tailored around the specific organisational and technological channels which will be used to facilitate the deal.  At a minimum, the degree of care extended to the security of the sellers’ data by the buyers should be that applied by the buyers to their own confidential information (in which case sellers should carry out reverse due-diligence to check that the buyers’ policies and processes are actually sufficient).  Any obligation on buyers to flow-down contractual confidentiality protections to advisors or employees who are permitted to receive the sellers’ confidential information should be strictly implemented.

· Virtual data rooms are now common practice in M&A, and are an efficient way to control and manage the flow of information.  However, by their very nature they are cyber data-sharing tools, so bring with them a whole host of cyber-risk concerns. In mitigation, most platforms are hosted by the sellers and password protected with individual accesses (including the ability to download, print or copy) restricted to specific areas and relevant documents. Documents can be watermarked to maintain confidentiality and due-diligence enquiries can be presented, updated and responded to all within the secure platform.  Sellers should be diligent to ensure that all parties restrict the flow of data exclusively to the data room and avoid using less secure channels such as email.

· Properly anonymised data is not subject to the requirements of the DPA, which imposes duties on data controllers in respect of disclosing “personal data”.  Sellers should therefore anonymise personal data before sharing.  It is recognised that in business purchase situations TUPE legislation will require the disclosure of certain personal employee information but this should still be anonymised to the fullest extent possible and supported by a well drafted confidentiality agreement.  Parties cannot avoid the application of the DPA if it is still possible to identify the individual from the anonymised data. 

From May 2018 a set of new data protection rules, designed to establish a modern and harmonised data protection framework across the EU, will replace the DPA and (amongst other things) put a positive obligation on organisations to report personal data breaches to the regulator within 72 hours of becoming aware of them (except where the breach is unlikely to result in risk to the individual).  Details of regulatory actions taken as a result of such disclosure will be publicly available.  Financial penalties will also massively increase.  Parties should therefore consider this impending change and its potential impact on timing, cost and deal-confidentiality if infringements occur during negotiations, and the buyer should also consider the wider, on-going implications for its (and the target’s) business post-completion.

· Cyber-security insurance is still in its relative infancy, with a 2015 government report on the role of insurance in cyber security suggesting that just 2% of large firms had explicit cyber cover, with the figure falling closer to zero for small firms.  However, demand for explicit protection is increasing, particularly in response to the shocking financial and reputational impact of some recent (and very public) cyber-infringements. 

The complexity of the cyber-risk category and general uncertainty around its ever-changing nature has previously made insurers question whether cyber-risks pose an opportunity or a threat to their industry. However, recent reports of Beazley and Munich Re teaming up to ‘push through the barriers’, doubling coverage amounts and including items such as physical damage (which are often excluded from policies in this area) suggest that now is a good time to ensure that target businesses and sellers/buyers alike are appropriately protected both pre and post completion. Increased regulatory focus and guidance (such as the recently published recommendations arising from parliament’s inquiry into cyber-security after the TalkTalk attack) may also make cyber-security risk easier to define and, in turn, insurance more accessible.

Whilst existing non-cyber specific insurance policies might respond to a cyber-attack event, this is still largely untested.  It is wise to address the issue explicitly, being careful to check the policy scope and exclusions. 

Cyber-security should be addressed at every stage of the M&A process; both in terms of risk within the target and risk within the deal process itself.  It is not just a due diligence risk for buyers.  Sellers, targets and advisors also need to stay alert to the potential for data breaches and/or cyber-attacks during negotiations and work together to mitigate the unique risks inherent within every deal.  Everyone must remember to constantly re-evaluate their cyber-risk management plans. 

Cyber-attacks will never be completely preventable: expect the unexpected and be prepared.  

Article written by Claire Miller at Stevens & Bolton. For further information, please visit their website, here.

 

Categories: Legal, M&A


You Might Also Like
Read Full PostRead - Eye Icon
Aligning Your Startup Business Strategy with Success
Strategy
27/01/2021Aligning Your Startup Business Strategy with Success

Are you ready to take the plunge into starting your own company? This decision is only the beginning. There are still several steps between making the decision and launching, and skipping any of them can reduce the likelihood of your success. By organizing you

Read Full PostRead - Eye Icon
How Can an Inquiry Be Used to Create Justice and Tackle Systemic Issues?
Legal
14/05/2025How Can an Inquiry Be Used to Create Justice and Tackle Systemic Issues?

Public inquiries are independent investigations launched to address events of public concern. They are designed to examine large-scale failures arising from regulatory breakdowns, corporate misconduct, or systemic injustices, and to propose solutions to preven

Read Full PostRead - Eye Icon
Building upon Success
Innovation
20/06/2017Building upon Success

Most Outstanding for Restoration Architecture 2017 award winner NFA architects is an established and experienced practice formed of a senior director with dedicated architects, designers and technologists based in Kent. We interviewed the firm’s Nick Farnell

Read Full PostRead - Eye Icon
How Do I Choose the Right Witnesses to Provide Evidence for a Public Inquiry?
Legal
14/05/2025How Do I Choose the Right Witnesses to Provide Evidence for a Public Inquiry?

Public inquiries are powerful tools in scrutinising business practices and often come with high stakes for the organisations involved.

Read Full PostRead - Eye Icon
How to Educate Remote Workforces About the Risks of WFH Scams
Leadership
20/05/2025How to Educate Remote Workforces About the Risks of WFH Scams

Although telework is generally beneficial, removing the face-to-face aspect from business-critical tasks has left some organizations vulnerable to work-from-home (WFH) scams. What are the latest schemes targeting remote workers, and what can employers do to he

Read Full PostRead - Eye Icon
How to Land a Great Role as an Intern in Your Dream Career Field
News
27/04/2023How to Land a Great Role as an Intern in Your Dream Career Field

Whether you’re in the finance or business industry, getting an internship can help you impress your future employers. With that said, landing a great intern role can be a challenge if you don’t know what you’re doing.

Read Full PostRead - Eye Icon
Htin Kyaw – What Now?
Leadership
11/05/2016Htin Kyaw – What Now?

With Myanmar swearing in its first elected civilian president in 50 years, we spoke to Krishna Ramachandra,

Read Full PostRead - Eye Icon
Due Diligence Solutions : Exceeding Clients Expectations
Legal
13/08/2019Due Diligence Solutions : Exceeding Clients Expectations

Due Diligence Solutions is an independent business supporting IFA/Firms to complete their platform and DFM due diligence review.

Read Full PostRead - Eye Icon
Audit Red Flags: 5 Signs You Need an IRS Audit Lawyer
News
22/04/2024Audit Red Flags: 5 Signs You Need an IRS Audit Lawyer

Tax season can be a time of elevated stress. An IRS audit raises that stress exponentially, even if you’re confident in your return filing. While IRS audits sometimes result from random selection, often the process can be more targeted. Knowing certain a



Our Trusted Brands

Acquisition International is a flagship brand of AI Global Media. AI Global Media is a B2B enterprise and are committed to creating engaging content allowing businesses to market their services to a larger global audience. We have a number of unique brands, each of which serves a specific industry or region. Each brand covers the latest news in its sector and publishes a digital magazine and newsletter which is read by a global audience.

Arrow