Home › Knowledge base › M&A archive due diligence
Business

Business takeover and archive due diligence

· 7 min read · DeSnipperaar

A business takeover comes with data rooms full of contracts, financials, IP portfolios and HR overviews. What is rarely or never in those data rooms: the physical and digital archive of the target company. Yet that archive is a source of risk, costs and legal obligations that you, as buyer, get on your plate after closing. This article shows what a sound archive due diligence entails.

Why archive belongs in due diligence

Three reasons:

  1. GDPR liability transfers. Personal data of customers and (former) employees in the old archive becomes your responsibility after closing. Including any flaws in the seller's retention policy.
  2. Tax and legal retention obligations come along. 7-year administration, contracts with running obligations, files of disputes.
  3. Operational costs of archive management. A target with 30 archive cabinets of old administration costs time and money to clear out.

The archive due diligence checklist

Volume and composition

  • How many linear metres of paper archive?
  • How much digital archive (TB on fileserver, SharePoints)?
  • Which age categories?
  • Which media types (paper, HDD, tape, microfilm. Read microfilm and old tapes)?

Compliance status

  • Are records of processing in place? Read records of processing.
  • Are retention periods documented?
  • Are those periods enforced?
  • Is there a destruction protocol?
  • Are there certificates of previous destructions?

BSN and special category personal data

  • How many BSN entries in old administration? Read BSN in old administration.
  • Special categories (medical, religious, trade union)?
  • Copies of identity documents?

Data breaches and incidents

  • Data breach register available?
  • Open or reported incidents at the AP?
  • Pending complaints or claims?
The question is not only "what does the company have in terms of archive?", but "what GDPR-risk legacy comes with the takeover?"

Risk categories

Low risk

  • Tidy retention-period administration, recent destruction certificates.
  • No copy-IDs outside a statutory basis.
  • Cloud systems with retention policy.

Medium risk

  • Archive not cleared in more than 7 years, but no special category personal data.
  • Rudimentary records of processing.
  • No destruction protocol formally documented.

High risk

  • BSN entries without a basis.
  • Copy-IDs in the archive of organisations without a Wwft or employer basis.
  • Mailboxes of departed employees still active.
  • No certificates of previous destructions.
  • Open data breach incident.

What you can negotiate in the SPA

Three clauses are relevant in the Sale and Purchase Agreement:

  • Representations and warranties on compliance, including GDPR and retention periods.
  • Specific indemnity for archive-related claims from the pre-closing period.
  • Pre-closing remediation: the seller carries out a targeted clean-up before closing, including destruction certificate.

Pre-closing clean-up: what and how

A popular approach: the seller organises a targeted destruction round in the weeks before closing:

  1. Identify transferable risks (BSN, old HR files).
  2. Plan on-site destruction.
  3. Destroy at DIN P-5 / H-5.
  4. Deliver the certificate to the buyer as an appendix in the closing package.

Benefit for the seller: lower SPA indemnity. Benefit for the buyer: less legacy risk.

Post-closing: integration

After closing, the target's archive is integrated or kept separate:

Integration

The archive merges with the buyer's. GDPR requirements run along; the records of processing are updated.

Kept separate

The target stays as an entity; its own archive and compliance. Often with carve-outs or standalone acquisitions.

Practical for M&A advisors

More and more advisory firms add archive due diligence to their standard process. For the archive component:

  • Request an archive-volume overview (see paper volume estimate).
  • Request the latest destruction certificates.
  • Request the records of processing.
  • Assess BSN retention for healthcare or HR companies.
  • Plan a pre-closing clean-up with an external supplier where needed.

Pre-closing clean-up, on-site.

We schedule destruction rounds for M&A trajectories with a certificate package that fits into the closing pack.

Request a quote

Planning an acquisition or sale? Email us via desnipperaar.nl about pre-closing archive clean-up. Discreet and with watertight documentation.