A Bengaluru private equity fund is screening targets in healthcare services. One of them is a chain of diagnostic labs in Tamil Nadu, with collection centres in Chennai, Coimbatore and Madurai. The fund signs an NDA, the seller's advisers open a data room, and the request list arrives: payroll for the last three years, employment contracts for senior staff, the top hundred corporate and individual customers by revenue, a sample of patient billing records to test revenue recognition, details of any data breaches, and copies of vendor contracts including the lab information system provider.
Almost every item on that list contains personal data. Some of it, like test results linked to named patients, is sensitive by any common sense standard. In many Indian deals, files like these are uploaded in full because the request list asked for them.
India's Digital Personal Data Protection Act, 2023, known as the DPDP Act, makes that habit risky for sellers, buyers and their advisers alike.
What the DPDP Act covers, briefly
The DPDP Act applies to the processing of digital personal data in India, and to some processing outside India connected with offering goods or services to people in India. Personal data means data about an individual who can be identified from it. Data that started on paper and was later scanned or entered into a system is covered once it is digital.
The Act calls the organisation that decides why and how personal data is processed a data fiduciary, and an organisation that processes data on its behalf a data processor. The people the data is about are data principals. In broad terms, a data fiduciary may process personal data only for a lawful purpose, on the basis of consent or certain legitimate uses the Act lists, must take reasonable security safeguards, must notify personal data breaches to the Data Protection Board of India and to affected people, and must erase data when the purpose is served, subject to legal retention needs. Data about children carries extra conditions.
The DPDP Rules were notified in November 2025, with most obligations phasing in over the following eighteen months. Penalties under the Act can be large, and commencement dates and guidance are still developing.
Why diligence is a problem under the Act
In the Tamil Nadu example, the lab chain is the data fiduciary for its patients' and employees' data. It collected that data to run tests, bill customers and pay staff. Sharing it with a private equity fund so the fund can decide whether to invest is a different purpose.
The Act has a limited exemption for processing needed for certain schemes of merger, amalgamation, compromise or arrangement that are approved by a court or tribunal. Most Indian share purchases, asset purchases and minority investments are not done through such a scheme, and the exemption does not cover the diligence that comes before an ordinary deal.
So the seller needs a basis for each disclosure, or needs to avoid disclosing personal data at all. In most cases the second is easier.
What sellers can do
Share less personal data
Most diligence questions can be answered without names. The fund wants to know whether payroll costs are accurate, whether key people are on proper contracts, whether revenue is real and whether customers are concentrated. Those questions can be answered with numbers, structures and samples, with names left out.
Practical ways to share less:
- Aggregate payroll by grade, department and location.
- Replace names with codes in customer and patient lists, and keep the key in the seller's hands.
- Redact patient identifiers in billing samples, keeping only what is needed to trace an invoice to a bank receipt.
- Share employment contract templates plus a schedule of variations.
- Disclose named records only for a small group of senior people whose terms matter to the deal, and only at a late stage.
Stage disclosure
Not every bidder needs every document. A common pattern is to give early bidders summary information, and to open more detailed folders only to the preferred bidder after a letter of intent. Truly sensitive data, if it must be seen at all, can go to a clean team: a small group of named advisers who report conclusions to the buyer without passing on the underlying records.
Control the data room
Set access by role and by folder. Record who opened which document and when. Turn off downloads for sensitive folders where that is practical. Close access promptly for bidders who drop out, and ask them to confirm deletion of anything they downloaded.
Fix the NDA
Standard Indian NDAs protect confidential business information. They often say little about personal data. Add clauses that limit use to evaluating the deal, require reasonable security, restrict onward sharing to named advisers, require notice of any breach, and require deletion or return when the process ends.
What buyers and their advisers should do
Buyers receive the data, so they carry risk too. Ask for anonymised data by default and push back on uploads you do not need. Keep downloaded files inside controlled systems, away from personal laptops and email. Make sure your own advisers, from the Big Four firm to the two person valuation boutique, are bound by the same terms. When a bid ends, delete what you received and record that you did.
It also helps to be clear about roles. The data room provider and the seller's own advisers usually act for the seller, which points towards them being processors working on the seller's instructions. A buyer and its advisers deciding for themselves what to do with the data look more like fiduciaries in their own right. The labels have consequences for who must protect the data and who answers for a breach, so settle them in writing with your lawyer.
Diligence on the target's own compliance
The DPDP Act is also a diligence topic in its own right. For a business like the lab chain, which handles health data at scale, the buyer will want to understand:
- What personal data the business holds, where, and for what purposes.
- Whether notices and consent records exist and match actual practice.
- How vendors such as the lab information system provider, the payment gateway and the courier partner handle data, and whether contracts cover it.
- Whether there have been breaches, how they were handled and whether they were reported.
- How long data is kept and whether anything is ever deleted.
- Who is responsible for data protection inside the business.
Gaps here become warranties and specific indemnities in the agreement, conditions to fix before closing, or items in the integration plan. A buyer that finds the target has never mapped its data has a real piece of work ahead, and should price it.
After closing, the combined business may need a proper compliance programme: a data inventory, notices, consent management, vendor checks and a breach response process. Code Colonies runs a separate platform for this, TrustOS (https://dpdpatrustos.com), and the work can be planned as part of the first hundred days.
A note on the seller's own position
Sellers sometimes assume that personal data risk passes to the buyer at closing. In a share sale, the company remains the same data fiduciary, so its past processing travels with it. In an asset sale, the selling company may still be answerable for what it did before the sale, and the transfer of customer and employee data to the buyer is itself a processing activity that needs a basis. Either way, the seller should get advice before the data room opens, well ahead of the first request for payroll.
Where you need professional advice
Before you open a data room that will hold personal data, take advice from a lawyer who works on data protection on: the basis for any disclosure, the NDA terms, how the DPDP Rules apply to your timeline, and any sector rules that add to the Act, such as those for health, financial or telecom data. Your CA and the deal lawyer should be part of the same conversation so that findings flow into the purchase agreement.
General information on a developing law; it is not legal advice.
How Synerger helps
Synerger's due diligence area keeps diligence requests, the virtual data room and the Q&A in one place. Access is set by role, per deal and per folder, and the audit trail shows who opened what. That makes staged disclosure, clean team folders and prompt removal of dropped bidders a matter of settings, and it gives you a record if anyone later asks who saw a document. It does not decide what may lawfully be shared. That judgement belongs to you and your advisers.
To see how requests, folders and permissions work in practice, read about Due diligence on Synerger.