Addressing data legacy issues in M&A

June 2021  |  FEATURE  |  MERGERS & ACQUISITIONS

Financier Worldwide Magazine

June 2021 Issue

As part of an M&A deal, the acquirer will typically inherit the target’s existing data. If steps are not taken to manage this data appropriately, problems can emerge. Acquirers need to give thought to potential data challenges and how to solve them, including evaluating legacy data, and deciding what to retain and how to archive and store it.

Unfortunately, robust data management is often overlooked, or underappreciated, in M&A. “In the context of M&A transactions, data storage and retention can be a significant challenge, especially with respect to legacy data,” says Céline Guillou, of counsel at Hopkins & Carley.

Following a merger, a range of challenging issues can surface, including data fragmentation and consolidation of engrained data silos. Some acquirers, for example, choose not to integrate the target’s data into their own systems, and instead keep a separate legacy system live to continue accessing the data. However, maintenance costs will mount, and there are risks if the platform is no longer updated or managed properly.

If legacy data is not addressed, overlapping data sets can quickly build up. Eventually, the combined company may struggle to understand exactly what information it holds and whether that information is current and essential, or a candidate for deletion.

“The ‘less is more’ approach is not aligned with today’s data-driven world, and organisations are often more concerned with the risks associated with permanently deleting data than the benefits of purging data that is either no longer necessary or cannot lawfully be retained,” says Ms Guillou. “Many do not methodically classify the data that they hold across different information systems, and even fewer implement data retention policies that dictate when data must be retained and when it must be deleted. As a result, many find themselves with volumes of data, and in particular decades-old legacy data dispersed among various – and often obsolete – systems.”

Regulatory considerations need to be taken into account. For example, in the early stages of a deal, there will always be some tension between releasing sensitive information to a prospective buyer and complying with data protection legislation. Ultimately, what information to hand over and when is a risk-based decision for the seller. Both buyers and sellers need to be aware of the volume of personal data handled throughout an M&A transaction, and prepare to address data protection issues at each stage.

Without a data management and retention plan, dealing with the transfer of legacy data can be a significant challenge. A key initial step is to analyse and interrogate the data. “Some legacy data has little value, and its ongoing retention or transfer presents more risks than benefits,” says Ms Guillou. “Conversely, some legacy data remains extremely valuable, but understanding its purpose and whether its transfer to a buyer will comply with applicable data protection obligations can be very tricky.”

Under the GDPR, organisations must create a data retention policy to manage the data they handle. In the absence of proper data retention risk assessments and policies, a seller may scramble to determine whether its legacy data should or even can be transferred to the buyer under applicable data protection laws.

“This can delay a transaction, reduce the target’s value or, in some cases, prevent the transaction from moving forward,” points out Ms Guillou. “As such, organisations would be well-advised to conduct data retention assessments and implement data retention policies long before any potential transfers are on the horizon.

“Once a comprehensive data retention risk assessment has been conducted, a data retention policy should be implemented, which will enable organisations to address the retention of all data, including legacy data,” she adds.

Given the amount of data companies store across various information systems, as well as the increasing regulatory burden due to measures such as the European Union’s (EU’s) General Data Protection Regulation (GDPR), it is imperative to have a comprehensive plan to manage data storage and retention issues.

The right approach to data retention can help acquirers reduce storage costs and avoid potential fines. Data archiving, for example, can help acquirers control costs without limiting accessibility. Archiving offers the ability to centralise records, encrypt data or store a variety of file types across multiple locations. It also enables companies to respond quickly and effectively to data requests.

Though larger, more complex deals make the data retention and integration process more challenging, whatever the deal size, acquirers should not underestimate the importance of data legacy issues when conducting M&A.

© Financier Worldwide

BY

Richard Summerfield