Cybersecurity, Data Privacy and Liability Review When Buying a Technology Company
An IT services company may hold administrative access to dozens of client networks. A software business may store customer data on behalf of every subscriber. When a buyer acquires either one, they take on responsibility for that access and data, along with any weaknesses in how it has been protected. Cybersecurity due diligence helps a buyer understand the company’s security practices, incident history, contractual commitments and potential liabilities before closing.
This article is general information for buyers of existing, operating technology companies. It does not provide technical security advice or explain privacy law, which varies by state, industry and the type of data involved. Buyers should rely on qualified attorneys and independent security professionals for this review. Nothing here is legal or technical advice.
Why Security Matters in a Technology Acquisition
- A security incident at a provider can affect many clients at once
- Client contracts may impose security obligations and liability for breaches
- Some clients operate in regulated fields with specific data requirements
- Undisclosed incidents can lead to claims after closing
- Insurance coverage may depend on security practices being in place
Questions Buyers Frequently Ask
- What written security policies exist and how are they followed in practice?
- Who has administrative access to company and client systems, and how is it controlled?
- Has the company experienced security incidents, and how were they handled and disclosed?
- What client or customer data does the company store, process or access?
- Has the company completed any outside security assessments?
- How are credentials stored, and how will they be transferred at closing?
An independent security professional can help evaluate the answers.
Contractual Commitments
Managed services agreements and software subscription terms may include security commitments, breach notification obligations, liability limits and indemnification provisions. Buyers should have counsel review these terms to understand potential exposure. See our article on managed services contracts.
Data Privacy Considerations
Depending on the data handled and where customers are located, privacy rules may apply to how data is collected, stored and transferred, including in a sale. Counsel should advise on what applies and whether a transaction triggers any notice or consent requirements. Some technology businesses may also face export questions if they sell software internationally; those should go to counsel as well.
Insurance
Buyers review the company’s insurance coverage, including any cyber liability and professional liability policies, along with claims history. Coverage terms and whether policies continue after a change of ownership should be reviewed with a qualified insurance professional.
Code and Infrastructure
For software businesses, security review may extend to how code is developed, how hosting is configured and how vulnerabilities are addressed. IP and security questions frequently overlap. See our article on software code ownership.
How Findings Affect the Deal
Security findings may lead to remediation before closing, specific representations and indemnities in the purchase agreement, escrow or holdback provisions or price adjustments. Attorneys should draft these protections. Our technology company due diligence checklist shows where security fits in the full review.
What Lenders May Ask
Lenders may ask about insurance coverage, pending claims and any known incidents as part of evaluating the business. See our article on technology company loan requirements.
For Sellers
Owners preparing for a sale can organize security policies, incident records and insurance documents in advance. See our guide on how to sell a technology company.
US Professional Funding helps buyers finance the acquisition of existing, operating technology companies. Learn more about our technology acquisition financing.
