© Copyright Acquisition International 2025 - All Rights Reserved.

Article Image - Cyber-Security in the M&A Process
Posted 22nd June 2016

Cyber-Security in the M&A Process

During an M&A deal process huge amounts of sensitive data is shared in the cyber-space between buyers, sellers and their respective advisors. Infringement of this data’s cyber-security could leave parties open to significant claims.

Mouse Scroll AnimationScroll to keep reading

Let us help promote your business to a wider following.

Cyber-Security in the M&A Process
Image

Cyber-Security in the M&A Process

During an M&A deal process huge amounts of sensitive data is shared in the cyber-space between buyers, sellers and their respective advisors. Infringement of this data’s cyber-security could leave parties open to significant claims. In addition to explicit contractual obligations which parties may impose upon each other in respect of data security, and regulatory duties imposed under legislation such as the Data Protection Act 1998 (DPA), both sellers and buyers (and any third party suppliers) will owe: (i) an equitable duty to individuals to preserve the confidentiality of their information, and (ii) a parallel duty through the tort of negligence to keep it secure.

How can parties be extra-vigilant to ensure that the security of the information being collated, reviewed and negotiated is not compromised or vulnerable to cyber-attack during the M&A process?

· Cyber-security policies and procedures should be carefully reviewed and updated by each party at the outset of the deal to ensure compliance with current best practice.

· Project names are a simple but effective security measure.  Especially in email traffic, which can be voluminous and rapid, project names and party pseudonyms (where allocated) should be carefully and consistently used.

· Confidentiality agreements should be cautiously drafted and tailored around the specific organisational and technological channels which will be used to facilitate the deal.  At a minimum, the degree of care extended to the security of the sellers’ data by the buyers should be that applied by the buyers to their own confidential information (in which case sellers should carry out reverse due-diligence to check that the buyers’ policies and processes are actually sufficient).  Any obligation on buyers to flow-down contractual confidentiality protections to advisors or employees who are permitted to receive the sellers’ confidential information should be strictly implemented.

· Virtual data rooms are now common practice in M&A, and are an efficient way to control and manage the flow of information.  However, by their very nature they are cyber data-sharing tools, so bring with them a whole host of cyber-risk concerns. In mitigation, most platforms are hosted by the sellers and password protected with individual accesses (including the ability to download, print or copy) restricted to specific areas and relevant documents. Documents can be watermarked to maintain confidentiality and due-diligence enquiries can be presented, updated and responded to all within the secure platform.  Sellers should be diligent to ensure that all parties restrict the flow of data exclusively to the data room and avoid using less secure channels such as email.

· Properly anonymised data is not subject to the requirements of the DPA, which imposes duties on data controllers in respect of disclosing “personal data”.  Sellers should therefore anonymise personal data before sharing.  It is recognised that in business purchase situations TUPE legislation will require the disclosure of certain personal employee information but this should still be anonymised to the fullest extent possible and supported by a well drafted confidentiality agreement.  Parties cannot avoid the application of the DPA if it is still possible to identify the individual from the anonymised data. 

From May 2018 a set of new data protection rules, designed to establish a modern and harmonised data protection framework across the EU, will replace the DPA and (amongst other things) put a positive obligation on organisations to report personal data breaches to the regulator within 72 hours of becoming aware of them (except where the breach is unlikely to result in risk to the individual).  Details of regulatory actions taken as a result of such disclosure will be publicly available.  Financial penalties will also massively increase.  Parties should therefore consider this impending change and its potential impact on timing, cost and deal-confidentiality if infringements occur during negotiations, and the buyer should also consider the wider, on-going implications for its (and the target’s) business post-completion.

· Cyber-security insurance is still in its relative infancy, with a 2015 government report on the role of insurance in cyber security suggesting that just 2% of large firms had explicit cyber cover, with the figure falling closer to zero for small firms.  However, demand for explicit protection is increasing, particularly in response to the shocking financial and reputational impact of some recent (and very public) cyber-infringements. 

The complexity of the cyber-risk category and general uncertainty around its ever-changing nature has previously made insurers question whether cyber-risks pose an opportunity or a threat to their industry. However, recent reports of Beazley and Munich Re teaming up to ‘push through the barriers’, doubling coverage amounts and including items such as physical damage (which are often excluded from policies in this area) suggest that now is a good time to ensure that target businesses and sellers/buyers alike are appropriately protected both pre and post completion. Increased regulatory focus and guidance (such as the recently published recommendations arising from parliament’s inquiry into cyber-security after the TalkTalk attack) may also make cyber-security risk easier to define and, in turn, insurance more accessible.

Whilst existing non-cyber specific insurance policies might respond to a cyber-attack event, this is still largely untested.  It is wise to address the issue explicitly, being careful to check the policy scope and exclusions. 

Cyber-security should be addressed at every stage of the M&A process; both in terms of risk within the target and risk within the deal process itself.  It is not just a due diligence risk for buyers.  Sellers, targets and advisors also need to stay alert to the potential for data breaches and/or cyber-attacks during negotiations and work together to mitigate the unique risks inherent within every deal.  Everyone must remember to constantly re-evaluate their cyber-risk management plans. 

Cyber-attacks will never be completely preventable: expect the unexpected and be prepared.  

Article written by Claire Miller at Stevens & Bolton. For further information, please visit their website, here.

 

Categories: Legal, M&A


You Might Also Like
Read Full PostRead - Eye Icon
5G Endless Opportunities and Possibilities
Innovation
31/08/20235G Endless Opportunities and Possibilities

There has been a lot of noise recently about AI but the real game changing technology that will revolutionise services and industries is 5G standalone that will deliver faster speeds, lower latency, and increase reliability ensuring we are always connected.

Read Full PostRead - Eye Icon
Protecting Clean Energy: The Importance of Bird-Proofing Your Company’s Solar Panels
News
03/11/2023Protecting Clean Energy: The Importance of Bird-Proofing Your Company’s Solar Panels

Solar panels are a great way to get the energy your office needs without using as many natural gases. Being able to get your own energy clean and long-lasting is good for both your company and the environment. Even though solar panels are a clean and long-last

Read Full PostRead - Eye Icon
Several Ways on How Engineering Innovations Make Your Business More Competitive
Innovation
13/09/2021Several Ways on How Engineering Innovations Make Your Business More Competitive

Wondering what kind of benefits engineering innovation can bring to business so that the last win competition among dozens of rivals? Keep reading this article!

Read Full PostRead - Eye Icon
Tushington Sails Funding led by Mobeus Equity
Finance
03/08/2015Tushington Sails Funding led by Mobeus Equity

Tushington Sails Funding led by Mobeus Equity

Read Full PostRead - Eye Icon
3 Questions Small Business Owners Should Ask Before Seeking Out a Business Loan
Finance
12/08/20213 Questions Small Business Owners Should Ask Before Seeking Out a Business Loan

If you run a business, no matter the size, there will be a time when you will need to seek financing. Let’s take a look at some questions all business owners should ask before seeking out a business loan.

Read Full PostRead - Eye Icon
2016 Intellectual Property Practitioner of the Year – Peru
Legal
31/07/20162016 Intellectual Property Practitioner of the Year – Peru

Over the years, Estudio Colmenares & Associados has grown to becoming the IP firm of choice in our region of Peru. Although there are a number of reasons why this is the case, we believe that our experience is what separates us form any of our competitors.

Read Full PostRead - Eye Icon
Global Insurance M&A Highest in Years Due to Low Interest Rates and Low Growth
Finance
11/11/2015Global Insurance M&A Highest in Years Due to Low Interest Rates and Low Growth

According to Moody's Investors Service the growth in M&A in the insurance industry, now at its highest level for many years, has been driven by the weak global economic environment and regulatory changes, spurring many groups to consider business sales, whilst

Read Full PostRead - Eye Icon
Empowering Individuals to Live a Life They Choose to Lead
Strategy
30/08/2019Empowering Individuals to Live a Life They Choose to Lead

Angel Heart Home Care provides support for vulnerable adults who are wanting to live independently within the community. Following their success in AI’s Global Excellence Awards 2019 where they were recognised as the Best Luxury Home Care Services Providers,

Read Full PostRead - Eye Icon
Technology Aftermarket Support Secures Success
Innovation
23/03/2020Technology Aftermarket Support Secures Success

Technical services and aftermarket support have become an increasingly important battleground for technology manufacturers as the expectations of consumers and end-users continue to rise. Rising to meet them is Qcom, a support partner which delivers these serv



Our Trusted Brands

Acquisition International is a flagship brand of AI Global Media. AI Global Media is a B2B enterprise and are committed to creating engaging content allowing businesses to market their services to a larger global audience. We have 14 unique brands, each of which serves a specific industry or region. Each brand covers the latest news in its sector and publishes a digital magazine and newsletter which is read by a global audience.

Arrow