In M&A transactions, privacy and data security matters have become an increasingly important concern for buyers given the role of data collection in many businesses, the heightened regulatory focus on these issues and the potential for public backlash arising from data breaches and other incidents.

In many transactions, buyers now conduct due diligence focused on privacy and data security matters and include provisions in the purchase or merger agreement that address the target business's privacy and data security practices. For more information on privacy and data security laws generally, see Practice Note, US Privacy and Data Security Law: Overview.

Privacy and data security representations are statements of fact and assurances made by the seller that disclose information about the seller's or target company's:

Like other representations and warranties, they:

For a discussion of market practice relating to privacy and data security due diligence and representations and warranties in M&A agreements, see Practice Note, What's Market: Privacy and Data Security Representations and Warranties in M&A Agreements.

For sample representations and warranties with integrated drafting notes with important explanations and drafting tips, see Standard Clauses, Privacy and Data Security Representations and Warranties.