TheDPDPAct.com -
Official WhatsApp Channel
Stay updated with the latest DPDP Act news, compliance insights, updates, and resources.
Join Our WhatsApp Channel →In September 2016, Marriott completed its acquisition of Starwood.
What it had bought included an intruder: according to the UK Information Commissioner's Office, Starwood's systems had been compromised since 2014, when an attacker installed a web shell on 29 July. The breach was discovered in September 2018, two years after the deal closed, and Marriott estimated that 339 million guest records were affected. A different deal reached a different ending.
In February 2017, Verizon and Yahoo amended their agreement after Yahoo disclosed data breaches, cutting the price by $350 million to about $4.48 billion. In both cases, the buyer learned about the security problem after it had committed. Cybersecurity due diligence exists to reverse that order.
Why Cybersecurity Due Diligence Belongs in Every Deal?
A target's security history becomes the buyer's problem on closing day.
The ICO's Marriott penalty notice recorded Marriott's position that it had been "only able to carry out limited due diligence on the Starwood data processing systems," and acknowledged that in-depth diligence of a competitor is not always possible during a takeover. But it accepted that an acquisition is a trigger for due diligence while stating that it "is not the only trigger point for such activity", and that it is "no answer" to claim certain steps were needed only after the acquisition, because the controller has an ongoing duty to ensure compliance.
The ICO's final fine was £18.4 million, against the £99.2 million it had first proposed. It related to the period after the GDPR took effect in May 2018. The lesson is that limited access to a target's systems does not remove the buyer's responsibility, and the work continues after signing.
The Indian Lens: Deals Closing Now Inherit DPDP Exposure
For deals in India, timing matters.
The DPDP Act's main duties are due to apply from about mid-May 2027, so a company acquired this quarter will operate under them within months, with penalties of up to INR 250 crore for failing to maintain reasonable security safeguards. Two practical points follow, both drawn from Indian law-firm commentary rather than the statute itself.
1. The target's data may not be free to use as the buyer plans.
LS Lakshmikumaran & Sridharan's May 2026 article notes that personal data in a non-exempt transaction needs a lawful purpose and, generally, consent, and that existing consents should be rechecked to see whether they cover the buyer's intended use. It also describes certain restructurings, such as court-approved mergers, as subject to lighter requirements, though duties like reasonable safeguards still apply. Counsel should confirm how this applies to your structure.
2. Diligence itself handles personal data.
The same authors recommend limiting access to personal data in the data room, keeping access logs, preferring anonymised or aggregated data early, and deleting diligence data if the deal collapses. These are practitioners' recommendations, not statutory requirements.
What to Assess: Eight Areas
A useful cybersecurity due diligence review combines documents, interviews, and technical evidence.
1. Incident history and hidden compromise. Ask for past incidents, regulator and CERT-In correspondence, breach notifications, and litigation. Then test the claim that nothing is wrong. Marriott's intruder went unnoticed for four years. A compromise assessment or threat hunt, where access allows, checks for what the questionnaire cannot.
2. External exposure. Internet-facing systems, remote access, and cloud configurations show how an attacker would see the business. A vulnerability assessment of the external surface can usually be done without deep access.
3. Governance and ownership. Who is accountable for security? Is there a policy set, a risk register, and board reporting? Check certifications such as ISO 27001 or SOC 2 for scope, dates, and exclusions, since a certificate covering one unit says little about the rest.
4. Identity and access. Multi-factor authentication, privileged account control, joiner-mover-leaver processes, and shared or orphaned accounts. Stolen credentials remain a common route in.
5. Data and privacy compliance. What personal data is held, where, on what consent or legal basis, and for how long. For India, test readiness against DPDP, including breach-notification capability.
6. Third parties and software supply chain. Vendor access, outsourcing, and open-source dependencies. As reported by Debevoise, the ICO rejected Marriott's argument that an outsourced security provider reduced its own responsibility. Verizon's 2026 DBIR, as reported by Help Net Security, found third-party involvement now accounts for nearly half of breaches, and IBM's India 2026 data lists supply chain compromise as the initial vector in 15%.
7. Legacy systems and integration risk. Check for the risk of integrating or upgrading legacy IT after a deal. Ask what will be connected to the buyer's network, and when.
8. Resilience and recovery. Backups, tested recovery, incident response plans, cyber insurance terms, and exclusions.
Working Within the Limits of Deal Access
Sellers rarely allow deep testing early, so stage the work.
* Before the offer: outside-in review of public exposure, plus open-source intelligence on past incidents.
* Before signing: a structured questionnaire backed by evidence, interviews with the security lead, and review of policies and recent test reports.
* Between signing and closing: confirmatory testing, where the agreement allows, and a compromise check on critical systems.
* After closing: a defined first-100-days plan to remediate, integrate, and re-test, because the Marriott notice treats diligence as continuing.
Turning Findings Into Deal Terms
A finding matters only if it changes something. The Verizon and Yahoo amendment shows the range of tools. Verizon negotiated a $350 million reduction, and Yahoo agreed to bear 50% of post-closing cash liabilities from non-SEC government investigations and third-party litigation over the breaches, while keeping shareholder suit and SEC investigation liabilities entirely. The amendment also excluded the breaches from the test for a material adverse effect.
Typical levers include price adjustment, escrow or holdback, specific indemnities, data-protection representations and warranties, conditions precedent, and remediation covenants. LS Lakshmikumaran & Sridharan expect more personal-data-specific representations and indemnities in Indian deals; that is their prediction, not a requirement.
Red Flags That Should Move Price or Timing
* Incidents the seller cannot document, or logs that do not exist.
* No named security owner, and no board visibility.
* Internet-facing systems that are unpatched, or remote access without multi-factor authentication.
* Personal data held without a clear basis or retention limit.
* Reluctance to allow any technical verification.
Where ILLUME Intelligence Can Help
ILLUME Intelligence supports buyers with security assessments and penetration testing of a target's exposed systems, DPDP compliance reviews of its data practices, and Virtual CISO support to plan integration and remediation after closing. A short pre-signing review scoped to your deal timeline is a practical starting point. We work alongside your legal and financial advisers, who lead on contract terms.
The Bottom Line
A deal buys a target's strengths and its history. Cybersecurity due diligence is how you read the history before you own it: look for past incidents and present compromise, test the exposed edges, check the data obligations, and price what you find. Stage the work, and keep going after signing.
