Access to a virtual data room (VDR) is a routine stage of any M&A transaction. It allows a prospective buyer to examine the target’s corporate, financial, contractual and employment affairs and identify potential issues before proceeding with the acquisition. When a transaction involves the EU and China, however, even an apparently routine step such as reviewing documents can raise significant questions about data protection and data flows. Employment contracts, information about employees and customers, commercial documents and other operational data may be made available to the buyer, its legal team and other advisers located in a jurisdiction different from that of the target. It is therefore necessary to assess not only which information is needed for due diligence, but also which data may be shared, with whom and by what means.
This issue is particularly relevant to transactions between the European Union and China, where Regulation (EU) 2016/679 (GDPR) and Chinese data protection and security laws regulate the processing and cross-border flow of information differently. Assessing these matters too late may require the disclosure process to be reorganised or access to the VDR to be restricted after due diligence is already under way, potentially affecting the transaction’s timetable and value.
From the EU perspective, the disclosure of documents containing personal data during due diligence must comply with the principles and obligations of the GDPR. The purpose of an M&A transaction does not permit unrestricted sharing of data. Rather, it requires an assessment of the legal basis for processing and compliance with, among others, the principles of purpose limitation, necessity and data minimisation. Where documents are made accessible to persons outside the European Economic Area, it is also necessary to determine whether the rules on international transfers apply and whether a GDPR transfer mechanism is required.
A similar assessment is needed, within a different regulatory framework, when data originates in China. The Personal Information Protection Law (PIPL), the Data Security Law (DSL) and other rules on data exports may be relevant when a Chinese target allows a buyer or its advisers located abroad to access its documents. In particular, hosting the VDR on servers in China does not necessarily rule out a cross-border data transfer: access from abroad to data stored in China may itself fall within the scope of the data export rules.
In both jurisdictions, it is therefore important to establish, before opening the data room, what information will actually be shared. Documents concerning employees, customers and counterparties may contain personal data and, in some cases, information subject to enhanced protection. This may include special categories of personal data in the EU and, in China, sensitive personal information, important data or information governed by specific sectoral rules.
Once the scope of disclosure has been defined, the next step is to determine how the deal team may access the data. In the EU, if sharing involves a transfer to a third country, it may be necessary to rely on a mechanism provided for by the GDPR, such as an adequacy decision or, in its absence, appropriate safeguards such as standard contractual clauses (SCCs), where applicable. In China, the applicable rules depend, among other factors, on the nature and volume of the data and the characteristics of the entity making the transfer. Specific exemptions may apply, or a mechanism such as the Standard Contract, certification or a security assessment may be required.
The presence of data subject to particular obligations or restrictions does not necessarily mean that due diligence must slow down or that access to the documents must be ruled out. Proper planning of the disclosure process can enable the buyer’s information needs to be met while complying with the obligations applicable in each jurisdiction.
In the early stages of a transaction, it may be appropriate to provide aggregated data, redacted documents, sample contracts or summaries of relevant information, reserving access to complete documents for cases where it is genuinely necessary. The VDR can also be configured according to the nature of the information, with different access permissions, restrictions on downloading and printing, suitable authentication measures and access logs.
For particularly sensitive information, the parties may also consider using a clean team or assigning the review to legal advisers based in the target’s jurisdiction. In the latter case, access to the documents can remain within the country, while the buyer and the deal team abroad receive only the information needed to assess the transaction and the principal issues identified during due diligence. This approach may be particularly useful where direct access to documents from abroad would trigger additional requirements that could delay closing, or where the nature of the information calls for greater caution. Any subsequent communication of the findings to the team abroad must still be structured in light of the applicable rules.
Access arrangements should therefore be defined during the planning stage of due diligence, identifying not only the documents to be made available, but also who may access them and from which countries. Addressing these questions only after the VDR has been opened to numerous advisers can make compliance more difficult and cause delays at the most sensitive stages of the transaction.
Moreover, the data implications do not end when due diligence is complete. If the review reveals significant issues, these may also affect the negotiation of the share purchase agreement through representations and warranties, remediation obligations, specific indemnities or conditions to closing.
It is also necessary to distinguish access to documents during due diligence from the subsequent migration of data after the acquisition is completed. The fact that a buyer was able to review certain documents in the VDR does not mean that, after closing, it can freely transfer the target’s databases into its global systems. This distinction can have a tangible economic impact where the expected synergies depend on centralising systems for personnel, customers, CRM, customer service or other operational functions. Restrictions on data flows may affect the time and cost of integration and should therefore be considered when assessing the transaction as a whole.
In practical terms, before opening the VDR, the parties should map the categories of data to be shared, identify who will access them and from which countries, determine whether restrictions, redactions or additional steps are needed, and establish alternative review arrangements for the most sensitive information from the outset. Before closing, the same analysis should be extended to the integration phase: the parties should determine which databases the buyer intends to centralise, what access will be needed within the group and whether the planned transfers can be carried out under the proposed operating model. In this way, data management becomes part of deal planning, reducing the risk that overlooked restrictions will later affect the transaction’s timetable, costs or expected synergies.
Data Protection as a Transaction Risk Access to a virtual data room (VDR) is a routine stage of any M&A transaction. It allows a prospective buyer to examine the target’s corporate, financial, contractual and employment affairs and identify potential issues before proceeding with the acquisition. When a transaction involves the EU and China, however, even
Vietnam’s investment framework has materially changed under the Law on Investment No. 143/2025/QH15 (“LOI 2025”), effective from 1 March 2026. The most important practical change for foreign investors is that, where market‑access conditions are satisfied, an investor may establish a Vietnamese economic organization and obtain its Enterprise Registration Certificate (“ERC”) before completing the procedure for
Kazakhstan is preparing a new customs framework for cross-border e-commerce. In July 2026, Kazakhstan adopted amendments introducing a separate customs regime for goods purchased through foreign online platforms. The reform forms part of a wider Eurasian Economic Union initiative and is expected to change how online purchases are declared, cleared and delivered to customers in
