Business takeover and archive due diligence
A business takeover comes with data rooms full of contracts, financials, IP portfolios and HR overviews. What is rarely or never in those data rooms: the physical and digital archive of the target company. Yet that archive is a source of risk, costs and legal obligations that you, as buyer, get on your plate after closing. This article shows what a sound archive due diligence entails.
Why archive belongs in due diligence
Three reasons:
- GDPR liability transfers. Personal data of customers and (former) employees in the old archive becomes your responsibility after closing. Including any flaws in the seller's retention policy.
- Tax and legal retention obligations come along. 7-year administration, contracts with running obligations, files of disputes.
- Operational costs of archive management. A target with 30 archive cabinets of old administration costs time and money to clear out.
The archive due diligence checklist
Volume and composition
- How many linear metres of paper archive?
- How much digital archive (TB on fileserver, SharePoints)?
- Which age categories?
- Which media types (paper, HDD, tape, microfilm. Read microfilm and old tapes)?
Compliance status
- Are records of processing in place? Read records of processing.
- Are retention periods documented?
- Are those periods enforced?
- Is there a destruction protocol?
- Are there certificates of previous destructions?
BSN and special category personal data
- How many BSN entries in old administration? Read BSN in old administration.
- Special categories (medical, religious, trade union)?
- Copies of identity documents?
Data breaches and incidents
- Data breach register available?
- Open or reported incidents at the AP?
- Pending complaints or claims?
The question is not only "what does the company have in terms of archive?", but "what GDPR-risk legacy comes with the takeover?"
Risk categories
Low risk
- Tidy retention-period administration, recent destruction certificates.
- No copy-IDs outside a statutory basis.
- Cloud systems with retention policy.
Medium risk
- Archive not cleared in more than 7 years, but no special category personal data.
- Rudimentary records of processing.
- No destruction protocol formally documented.
High risk
- BSN entries without a basis.
- Copy-IDs in the archive of organisations without a Wwft or employer basis.
- Mailboxes of departed employees still active.
- No certificates of previous destructions.
- Open data breach incident.
What you can negotiate in the SPA
Three clauses are relevant in the Sale and Purchase Agreement:
- Representations and warranties on compliance, including GDPR and retention periods.
- Specific indemnity for archive-related claims from the pre-closing period.
- Pre-closing remediation: the seller carries out a targeted clean-up before closing, including destruction certificate.
Pre-closing clean-up: what and how
A popular approach: the seller organises a targeted destruction round in the weeks before closing:
- Identify transferable risks (BSN, old HR files).
- Plan on-site destruction.
- Destroy at DIN P-5 / H-5.
- Deliver the certificate to the buyer as an appendix in the closing package.
Benefit for the seller: lower SPA indemnity. Benefit for the buyer: less legacy risk.
Post-closing: integration
After closing, the target's archive is integrated or kept separate:
Integration
The archive merges with the buyer's. GDPR requirements run along; the records of processing are updated.
Kept separate
The target stays as an entity; its own archive and compliance. Often with carve-outs or standalone acquisitions.
Practical for M&A advisors
More and more advisory firms add archive due diligence to their standard process. For the archive component:
- Request an archive-volume overview (see paper volume estimate).
- Request the latest destruction certificates.
- Request the records of processing.
- Assess BSN retention for healthcare or HR companies.
- Plan a pre-closing clean-up with an external supplier where needed.
Pre-closing clean-up, on-site.
We schedule destruction rounds for M&A trajectories with a certificate package that fits into the closing pack.
Request a quotePlanning an acquisition or sale? Email us via desnipperaar.nl about pre-closing archive clean-up. Discreet and with watertight documentation.