Privacy in M&A: Data Is an Asset With Conditions

A merger or acquisition can move personal data to a new owner without removing the conditions under which it was collected. Texas's privacy law excludes these transfers from its definition of a "sale," but the buyer still inherits the seller's promises and the law's purpose limits. This guide covers diligence, representations, and integration for buyers and sellers.

What the law requires

Under the Texas Data Privacy and Security Act (TDPSA), the disclosure or transfer of personal data to a third party as an asset that is part of a merger or acquisition is not a "sale of personal data" (§541.001(28)(E)). The transfer therefore does not trigger consumers' right to opt out of sales.

The exclusion does not free the data from its original terms. A controller may not process personal data for a purpose that is neither reasonably necessary to nor compatible with the purposes disclosed to the consumer, unless the consumer consents (§541.101(b)(1)). A buyer that wants to use acquired data for something new may need new notice or consent. Other laws, contracts, and the seller's own privacy promises can also limit both diligence and post-closing use. Two Texas examples:

• Student data. An education technology company's covered student information may pass in a merger only if the successor keeps complying with Education Code chapter 32, subchapter D (§32.152(c)(1)).
• Genomic data. In a bankruptcy sale, a covered entity may not transfer Texans' genome sequencing data to a foreign adversary or an entity linked to one (Health & Safety Code §174.006).

Diligence

Compare the target's privacy notices with what it actually collects; identify sensitive and regulated data sets; check consent and opt-out records; review security incidents and contacts with regulators; and read processor contracts for limits on assignment and change of control. In early diligence, use aggregates, redacted records, clean rooms, or synthetic samples where possible instead of live personal data.

Related topics

• Data Licenses, Transactions, and Data as an Asset
• Bankruptcy Sales and the Consumer Privacy Ombudsman
• Texas v. 23andMe (bankruptcy court)
• What Is the TDPSA

Sources and legal update

• Texas Business & Commerce Code §§541.001(28)(E), 541.101(b)(1)
• Texas Education Code §32.152(c)(1)
• Texas Health & Safety Code §174.006

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.