© Copyright Acquisition International 2025 - All Rights Reserved.

Article Image - Cyber-Security in the M&A Process
Posted 22nd June 2016

Cyber-Security in the M&A Process

During an M&A deal process huge amounts of sensitive data is shared in the cyber-space between buyers, sellers and their respective advisors. Infringement of this data’s cyber-security could leave parties open to significant claims.

Mouse Scroll AnimationScroll to keep reading

Let us help promote your business to a wider following.

Cyber-Security in the M&A Process
Image

Cyber-Security in the M&A Process

During an M&A deal process huge amounts of sensitive data is shared in the cyber-space between buyers, sellers and their respective advisors. Infringement of this data’s cyber-security could leave parties open to significant claims. In addition to explicit contractual obligations which parties may impose upon each other in respect of data security, and regulatory duties imposed under legislation such as the Data Protection Act 1998 (DPA), both sellers and buyers (and any third party suppliers) will owe: (i) an equitable duty to individuals to preserve the confidentiality of their information, and (ii) a parallel duty through the tort of negligence to keep it secure.

How can parties be extra-vigilant to ensure that the security of the information being collated, reviewed and negotiated is not compromised or vulnerable to cyber-attack during the M&A process?

· Cyber-security policies and procedures should be carefully reviewed and updated by each party at the outset of the deal to ensure compliance with current best practice.

· Project names are a simple but effective security measure.  Especially in email traffic, which can be voluminous and rapid, project names and party pseudonyms (where allocated) should be carefully and consistently used.

· Confidentiality agreements should be cautiously drafted and tailored around the specific organisational and technological channels which will be used to facilitate the deal.  At a minimum, the degree of care extended to the security of the sellers’ data by the buyers should be that applied by the buyers to their own confidential information (in which case sellers should carry out reverse due-diligence to check that the buyers’ policies and processes are actually sufficient).  Any obligation on buyers to flow-down contractual confidentiality protections to advisors or employees who are permitted to receive the sellers’ confidential information should be strictly implemented.

· Virtual data rooms are now common practice in M&A, and are an efficient way to control and manage the flow of information.  However, by their very nature they are cyber data-sharing tools, so bring with them a whole host of cyber-risk concerns. In mitigation, most platforms are hosted by the sellers and password protected with individual accesses (including the ability to download, print or copy) restricted to specific areas and relevant documents. Documents can be watermarked to maintain confidentiality and due-diligence enquiries can be presented, updated and responded to all within the secure platform.  Sellers should be diligent to ensure that all parties restrict the flow of data exclusively to the data room and avoid using less secure channels such as email.

· Properly anonymised data is not subject to the requirements of the DPA, which imposes duties on data controllers in respect of disclosing “personal data”.  Sellers should therefore anonymise personal data before sharing.  It is recognised that in business purchase situations TUPE legislation will require the disclosure of certain personal employee information but this should still be anonymised to the fullest extent possible and supported by a well drafted confidentiality agreement.  Parties cannot avoid the application of the DPA if it is still possible to identify the individual from the anonymised data. 

From May 2018 a set of new data protection rules, designed to establish a modern and harmonised data protection framework across the EU, will replace the DPA and (amongst other things) put a positive obligation on organisations to report personal data breaches to the regulator within 72 hours of becoming aware of them (except where the breach is unlikely to result in risk to the individual).  Details of regulatory actions taken as a result of such disclosure will be publicly available.  Financial penalties will also massively increase.  Parties should therefore consider this impending change and its potential impact on timing, cost and deal-confidentiality if infringements occur during negotiations, and the buyer should also consider the wider, on-going implications for its (and the target’s) business post-completion.

· Cyber-security insurance is still in its relative infancy, with a 2015 government report on the role of insurance in cyber security suggesting that just 2% of large firms had explicit cyber cover, with the figure falling closer to zero for small firms.  However, demand for explicit protection is increasing, particularly in response to the shocking financial and reputational impact of some recent (and very public) cyber-infringements. 

The complexity of the cyber-risk category and general uncertainty around its ever-changing nature has previously made insurers question whether cyber-risks pose an opportunity or a threat to their industry. However, recent reports of Beazley and Munich Re teaming up to ‘push through the barriers’, doubling coverage amounts and including items such as physical damage (which are often excluded from policies in this area) suggest that now is a good time to ensure that target businesses and sellers/buyers alike are appropriately protected both pre and post completion. Increased regulatory focus and guidance (such as the recently published recommendations arising from parliament’s inquiry into cyber-security after the TalkTalk attack) may also make cyber-security risk easier to define and, in turn, insurance more accessible.

Whilst existing non-cyber specific insurance policies might respond to a cyber-attack event, this is still largely untested.  It is wise to address the issue explicitly, being careful to check the policy scope and exclusions. 

Cyber-security should be addressed at every stage of the M&A process; both in terms of risk within the target and risk within the deal process itself.  It is not just a due diligence risk for buyers.  Sellers, targets and advisors also need to stay alert to the potential for data breaches and/or cyber-attacks during negotiations and work together to mitigate the unique risks inherent within every deal.  Everyone must remember to constantly re-evaluate their cyber-risk management plans. 

Cyber-attacks will never be completely preventable: expect the unexpected and be prepared.  

Article written by Claire Miller at Stevens & Bolton. For further information, please visit their website, here.

 

Categories: Legal, M&A


You Might Also Like
Read Full PostRead - Eye Icon
Xplore Agrees to Purchase Motion Computing
Finance
Read Full PostRead - Eye Icon
Kodiak’s Acquisition of Zarsky Lumber
M&A
21/05/2015Kodiak’s Acquisition of Zarsky Lumber

Kodiak's Acquisition of Zarsky Lumber

Read Full PostRead - Eye Icon
The AI Revolution: How Artificial Intelligence is Transforming Web Design Agencies
News
09/05/2023The AI Revolution: How Artificial Intelligence is Transforming Web Design Agencies

Artificial Intelligence (AI) has become an integral part of our lives, transforming industries and paving the way for new opportunities in various sectors. One such industry that has experienced significant changes is the web design industry.

Read Full PostRead - Eye Icon
Bringing New Life to Life Science Businesses
Innovation
25/02/2022Bringing New Life to Life Science Businesses

Working hard to deliver expert consultancy services to the life sciences industry, LifeBee srl has made itself the ‘Most Innovative Digital Solutions Provider for Life Sciences’ in 2021 for Italy.

Read Full PostRead - Eye Icon
How Do I Ensure My Business Survives in the Modern Day?
Strategy
19/01/2024How Do I Ensure My Business Survives in the Modern Day?

When it comes to the modern day, businesses have an opportunity to fall at the waste side or adapt to the developing technologies. Technological development and the introduction of the Internet have brought various businesses opportunities to grow and succeed

Read Full PostRead - Eye Icon
Wells Fargo Announces New Startup Accelerator Class
Finance
17/11/2015Wells Fargo Announces New Startup Accelerator Class

Three Bay Area startups seek to shape the future of financial services.

Read Full PostRead - Eye Icon
Tackling Bad Data at Source is Key to Cost-Effective Data Engineering Projects
News
08/10/2024Tackling Bad Data at Source is Key to Cost-Effective Data Engineering Projects

Despite the obvious importance of quality assurance in ensuring data projects are accurate from conception to deployment, this is a process that many tech companies struggle to perfect.

Read Full PostRead - Eye Icon
5 Types of Offices Ideal for a Start up Business
News
23/10/20235 Types of Offices Ideal for a Start up Business

Running a successful business entails a lot of responsibilities. They range from formulating a winning business model and identifying your target market audience to overseeing day-to-day business activities.

Read Full PostRead - Eye Icon
5 Technology Solutions for Inventory Tracking in the Apparel Sector
News
22/12/20235 Technology Solutions for Inventory Tracking in the Apparel Sector

In the fast-paced world of the apparel industry, efficient inventory management is a critical factor for success. In fact, the global apparel market exhibited substantial growth from $610.12 billion in 2022 to $652.94 billion in 2023, reflecting a notable comp



Our Trusted Brands

Acquisition International is a flagship brand of AI Global Media. AI Global Media is a B2B enterprise and are committed to creating engaging content allowing businesses to market their services to a larger global audience. We have 14 unique brands, each of which serves a specific industry or region. Each brand covers the latest news in its sector and publishes a digital magazine and newsletter which is read by a global audience.

Arrow