Asset Purchase Agreement And Gdpr

If the sale of the database is part of a share purchase transaction, the person in charge of the processing remains the same. Nevertheless, the buyer wishes to be satisfied, as part of due diligence, that the data protection requirements for the database are being met. Personal dataInformation relating to an identified or identifiable individual…. is one of a company`s most valuable assets. Understanding and realizing its value is an important factor in buying and selling a business. With regard to assisting clients involved in merger and acquisition transactions, DPO`s experience shows that data protection considerations boil down to four fundamental issues: if the parties reach an agreement on the transaction after due diligence, they will sign a contract to seal the deal. Such an agreement can be either a share purchase agreement, a contract to purchase assets, or a combination of the two. Where specific violations have been found in the due diligence procedure, the purchaser must check, given the seriousness, whether the seller expects the seller to correct these violations before closing or assume the associated economic risks (such as fines or damages). In the case of offences that can be corrected relatively easily (for example. B no DSB has been named), a precondition for the transaction may be such as to require the seller to correct the infringements before the transaction is concluded. If, during the due diligence phase, an identifiable risk, such as. B the absence of data processing agreements, is discovered during the due diligence phase, a specific compensation or a price correction could provide a solution.

Finally, risks of non-compliance with the RGPD that were not detected during due diligence should be covered by a guarantee to ensure the accuracy of the actions taken or the current state of affairs, for example. B that the company fully complies with the RGPD, that there are no ongoing data protection disputes, or that no data breaches have occurred in the last 3 years. While the first two means of protection depend, on the one hand, on the importance of data protection and the violation itself and the bargaining power of the parties, on the other hand, and are therefore less widespread in practice, a data protection guarantee is a necessity in each R and D contract. Insert the following new definitions in the asset purchase contract. : Especially in a trade and assets, instead of a share sale, remember that the new owner`s privacy policy may no longer apply. Also keep in mind that in the event of a change of ownership, consent cannot be transferable unless this possibility has been seen and indicated at the time of consent and is reflected in the confidentiality policy in place at the time of the issuance of consent.