DATA PROTECTION IN MERGERS & ACQUISITION TRANSACTIONS IN NIGERIA – KEY RISK AND COMPLIANCE CONSIDERATIONS
BY ADERONKE ALEX-ADEDIPE & ENIOLA SOGBESAN
Introduction
Traditionally, Mergers & Acquisition (M&A) transactions have focused primarily on issues such as valuation, financing arrangements, tax implications and regulatory approvals. Although data protection was not entirely absent from due diligence exercises, it was rarely treated as a separate area of consideration before the enactment of the Nigeria Data Protection Act, 2023 (the “NDPA”).
The introduction of the NDPA, alongside the growing commercial importance of personal data and increased regulatory scrutiny, has changed the approach to data protection in M&A transactions. Personal data is no longer viewed merely as information required for day-to-day business operations. It is increasingly recognized as a valuable business asset, as well as a potential source of legal and regulatory exposure that may influence transaction valuation, completion risks and the integration of the target business following an acquisition.
Consequently, data protection has become an integral component of M&A risk assessment rather than an incidental compliance issue. Buyers, sellers, and their advisers are increasingly expected to identify, assess, and allocate data protection risks throughout the transaction lifecycle, making data privacy due diligence a standard feature of modern Nigerian M&A practice.
Legal and Regulatory Framework for Data Protection in Nigeria
Nigeria’s data protection regime is founded on both constitutional provisions and statutory instruments. At the constitutional level, Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended) guarantees the right to privacy, providing the foundation for the protection of personal information.
The NDPA is the primary statutory framework governing the processing of personal data in Nigeria. Its application extends to transactions involving the processing of personal data of Nigerian data subjects, as well as processing activities carried out within Nigeria. The Nigeria Data Protection Commission (the “NDPC”) is responsible for the administration and enforcement of the NDPA.
Further guidance on the implementation of the NDPA is provided under the NDPC’s General Application and Implementation Directive (the “GAID”). The GAID sets out specific compliance requirements, establishes classification thresholds for data controllers and processors, and provides further direction on matters such as lawful processing and the transfer of personal data across borders.
The territorial reach of the NDPA is particularly significant in cross-border M&A transactions. A foreign investor or acquiring entity may fall within the scope of the NDPA where its activities involve the processing of personal data of Nigerian data subjects or otherwise satisfy the NDPA’s applicability requirements. Accordingly, the acquisition of a Nigerian business with existing data processing operations may require the foreign acquirer to comply with direct obligations under Nigeria’s data protection framework, making regulatory compliance an important consideration in structuring and executing the transaction.
Data Protection Due Diligence
Due diligence is a fundamental aspect of any M&A transaction, particularly where the nature, volume and sensitivity of personal data held by the target business present potential regulatory exposure. It is therefore important that the exercise goes beyond the standard review of commercial, financial and operational matters to include a deliberate assessment of the target’s data protection practices and governance arrangements, guided by the level of risk associated with its data processing activities.
The handling of personal data is often central to an M&A transaction, especially where the transaction involves access to or the transfer of employee, customer and other stakeholder information. In view of this, an early assessment of the target’s compliance with applicable data protection requirements is necessary to establish whether personal data is processed on a lawful basis and subject to appropriate safeguards. It also provides an opportunity to identify existing compliance deficiencies and determine whether corrective measures should be undertaken before the transaction is completed.
A proper review will ordinarily consider the categories of personal data processed by the target, the purposes and legal bases for such processing, and the adequacy of its privacy, information security and internal control measures. The assessment should also establish whether the target falls within the category of a data controller or data processor of major importance under the NDPA and applicable regulatory directives. This distinction is significant, as such classification may subject the target to additional compliance requirements, reporting obligations and regulatory supervision.
Regulatory Risk Identification and Deal Impact
In the context of an M&A transaction, data protection due diligence should go beyond identifying areas of non-compliance. Its broader purpose should establish the nature and extent of the risks involved and assess how these may affect the commercial terms of the transaction.
Certain findings may point to significant regulatory exposure. These may include the absence of a valid legal basis for material data processing activities, inadequate cybersecurity measures, unreported or unresolved personal data breaches, and cross-border transfers of personal data that do not meet applicable legal requirements. Where any of these issues arise, the parties must consider the extent of the exposure and its possible legal, financial and reputational consequences for the target business and the transaction.
The impact on the deal will depend largely on the nature and severity of the identified risks. For instance, an ongoing regulatory investigation, enforcement action or an outstanding administrative fine may influence the valuation of the target and the commercial terms agreed between the parties. Depending on the circumstances, the buyer may also seek specific indemnities or more detailed warranties to address identified exposures. In other cases, the parties may agree to make the resolution of identified compliance deficiencies a condition precedent to completion, thereby ensuring that material data protection issues are addressed before the transaction is concluded.
Virtual Data Rooms and Controlled Disclosure
Virtual Data Rooms (VDRs) have become an important feature of due diligence in contemporary M&A transactions, providing a secure and organized platform for the exchange of transaction-related information. However, the use of these platforms also raises data protection concerns, particularly where the information made available includes personal data belonging to employees, customers and other individuals. Such information may be accessed by several parties involved in the transaction, including prospective buyers, legal and financial advisers and, in certain circumstances, recipients located outside Nigeria.
In ensuring compliance with the NDPA, the disclosure of personal data through a VDR must be properly controlled. Given that VDR providers will generally process personal data on behalf of the party engaging their services, their role and corresponding obligations as data processors should be clearly established. The information uploaded should also be limited to what is necessary for the purposes of the transaction, in keeping with the principle of data minimization. Where personal data must be made available, appropriate protective measures should be implemented. These may include redacting or anonymizing identifying information, encrypting stored documents, restricting access to authorised users and maintaining audit trails to track access and preserve accountability throughout the due diligence exercise.
The confidentiality arrangements governing the transaction should equally extend to the treatment of personal data within the VDR. In particular, confidentiality undertakings should address the permitted use of information, restrictions on further disclosure and the retention or disposal of data at the conclusion of the due diligence process.
Cross-Border Data Transfers
Cross-border data transfers are a common feature of M&A transactions, particularly where the prospective purchaser, its parent company or professional advisers are based outside Nigeria. In such circumstances, the movement of personal data from Nigeria to another jurisdiction must be undertaken in accordance with the requirements of Sections 41 and 42 of the NDPA and Schedule 5 of the GAID.
Where a transaction involves making personal data relating to the target’s employees, customers, vendors or other stakeholders available to a prospective purchaser or its advisers outside Nigeria, the parties must consider whether the destination country provides an adequate level of data protection. In determining adequacy, the NDPC may take into account several factors, including the availability of enforceable rights for data subjects, effective mechanisms for seeking redress, cooperation arrangements between relevant enforcement authorities, and the existence of an independent supervisory authority with sufficient powers to oversee data protection compliance.
Where the NDPC has not made an adequacy determination in respect of the receiving jurisdiction, the parties must rely on an appropriate alternative transfer mechanism permitted under the NDPA. In practice, these may include the use of standard contractual clauses, binding corporate rules where the transfer takes place within the same corporate group, or the explicit and informed consent of the affected data subjects, where the applicable statutory requirements are satisfied.
Post Completion & Compliance Provisions
- Post-Acquisition Data Migration and Integration: At the conclusion of the transaction, personal data held by the target company is often migrated into the acquiring entity’s systems or integrated into shared data infrastructure. During migration and integration, organisations must ensure that the transfer and consolidation of databases comply with core data protection principles such as data minimization, purpose limitation, and security of processing. Technical and organizational measures should be implemented to safeguard personal data during system integration, including encryption, access controls, and secure transfer protocols.
- Post-Completion Compliance Audit: Following completion, the combined entity may process a larger volume of personal data, potentially placing it within a higher category of data controllers or processors of major importance under the GAID. Each category attracts specific registration fees and compliance requirements. Where the applicable thresholds are exceeded, the entity must review its classification, update its registration with the NDPC and ensure that it meets the additional obligations associated with its new category.
- Updating privacy policies, data retention practices and governance framework: Following completion of the transaction, the acquiring entity should review and update the target’s privacy policies, data retention procedures and governance structures to reflect any changes arising from the acquisition. Any changes in ownership, control or data processing activities should be captured in revised privacy notices, including details of new data controllers, processors and third-party recipients.Where processing materially differs from original disclosures, fresh consent may be required. Retention policies must be reviewed to ensure lawful storage periods, and governance frameworks harmonized across the merged entity. This includes appointment or confirmation of a Data Protection Officer where required, staff training, and unified compliance oversight mechanisms.
Conclusion
Personal data protection has become an important consideration in M&A transactions, extending beyond routine legal compliance to influence transaction valuation, deal structuring, completion risks and post-acquisition integration. With increased regulatory attention under the NDPA, weaknesses in a target’s data protection practices may have consequences beyond regulatory sanctions. They may affect the commercial terms of a transaction, influence negotiations and, in more serious cases, raise concerns about whether the transaction should proceed on the proposed terms.
It is therefore important for parties to consider data protection at every stage of the transaction, from initial due diligence and risk assessment to completion and post-acquisition integration. Taking this approach allows buyers and sellers to identify potential liabilities early, protect the value of the business and ensure that the combined entity meets its regulatory obligations.