Legal & Tax
GDPR and business disposal: how to manage the transfer of user data
A SaaS sale involves transferring personal data to a third party. GDPR strictly governs this transfer, mistakes can block a deal or expose the acquirer to CNIL sanctions.
GDPR (EU Regulation 2016/679) strictly governs data transfers in M&A. Mistakes can block a deal in due diligence, expose the acquirer to sanctions (CNIL France, DSB Austria, FDPIC Switzerland), or trigger collective user proceedings.
Share deal vs asset deal: GDPR impact
In a share deal, the company remains the same, there is technically no "new data controller". Simplest GDPR scenario. In an asset deal, there is a controller change, which may require prior notification to users (Article 14 GDPR). The most commonly invoked legal basis is legitimate interest (Art. 6.1.f), documented via a Legitimate Interest Assessment (LIA).
GDPR due diligence: acquirer checklist
- Processing register (Art. 30): lists processing, legal bases, retention periods, sub-processors. Its absence = major red flag.
- DPA with all sub-processors (AWS, Stripe, Intercom, Mixpanel…): current and compliant post-Schrems II (transfers outside EU).
- GDPR-compliant privacy policy (right to erasure, portability, opposition): a 2018 policy not updated no longer passes 2026 due diligence.
- Security incidents last 36 months (Art. 33): an incident not notified to authority within 72h represents a residual legal risk to be placed in escrow.
72h
Security incident notification delay (Art. 33 GDPR)
4%
Maximum GDPR fine (% annual worldwide turnover)
Art.30
Processing register, key due diligence document
DPA
To check for each sub-processor (AWS, Stripe…)
This article was written with the assistance of artificial intelligence and reviewed under Aegryn editorial responsibility. In accordance with Article 50 of the EU AI Act, we assume editorial responsibility for this content.
Ready to submit your asset or access the catalogue?