Data protection as a risk factor in restructurings
Restructurings are part of day-to-day business for many companies in current commercial practice. Several groups of advisers are regularly involved in such processes; at the same time, decisions and implementation steps are often subject to considerable time pressure. In this situation, data protection requirements are not infrequently treated as secondary, even though they require careful review even outside transaction and restructuring scenarios.
Neglecting data protection requirements can have significant consequences. In restructurings, a large number of natural persons are regularly affected, in particular employees, customers or business partners. These persons may assert potential data protection violations or contact the competent supervisory authorities. In the event of infringements in a transaction context, fines of up to EUR 20 million or up to 4 percent of worldwide annual turnover may be considered.
The following article presents the key data protection principles in connection with restructurings. The focus is in particular on corporate transactions, due diligence reviews and the disclosure of personal data to potential purchasers.
Data protection starting points under the GDPR
The Datenschutz-Grundverordnung (DSGVO, General Data Protection Regulation/GDPR) contains the central terms and fundamental principles that must be observed in any processing of personal data. For restructurings, it is essential that even preparatory measures may constitute processing of personal data.
Personal data and identifiability
Personal data are, pursuant to Art. 4 No. 1 DSGVO, any information relating to an identified or identifiable natural person. It is therefore not only decisive whether a person is directly named. What is also decisive is whether they can be identified by means available or likely to be usable.
For the assessment of identifiability, Recital 26 DSGVO requires consideration of the means that the controller or another person is reasonably likely to use to identify a person. Accordingly, even seemingly reduced data sets may remain personal data if attribution is possible with readily available additional information.
Processing of personal data
The concept of processing is broad. Pursuant to Art. 4 No. 2 DSGVO, it covers any operation or set of operations in connection with personal data, regardless of whether automated means are used.
This includes in particular:
- collection and recording,
- organisation, structuring and storage,
- adaptation or alteration,
- retrieval, consultation and use,
- disclosure by transmission or otherwise making available,
- alignment and combination,
- restriction, erasure and destruction.
In restructurings, processing therefore already occurs when employee lists are prepared, organisational charts are passed on or data sets are uploaded to a data room.
Principles under Art. 5 DSGVO
Art. 5 DSGVO contains the central principles for any processing of personal data. For restructurings, lawfulness, transparency, purpose limitation and data minimisation are particularly important.
Pursuant to Art. 5 para. 1 lit. a DSGVO, personal data may be processed only lawfully, fairly and in a manner that is transparent to the data subject. It follows that every processing operation requires a sound legal basis and that the principle of proportionality must be observed. At the same time, transparency is intended to prevent data subjects from being unable to assert possible legal violations due to lack of knowledge.
According to Recital 39 DSGVO, natural persons should be able to understand whether personal data concerning them are collected, used, accessed or otherwise processed. The scope and future processing should also be apparent to them. Information and communications relating to processing must be easily accessible, understandable and formulated in clear and plain language.
Art. 5 para. 1 lit. b DSGVO requires purpose limitation. Personal data must be collected for specified, explicit and legitimate purposes and must not be further processed in a manner incompatible with those purposes. The purpose must already be determined at the time of data collection.
Art. 5 para. 1 lit. c DSGVO imposes an obligation of data minimisation. Processing must be adequate and relevant to the respective purpose and limited to what is necessary.
Legal bases for data processing
A legal basis is required for every processing of personal data. Since the judgment of the Gerichtshof der Europäischen Union (Court of Justice of the European Union) of 30 March 2023, the national basis of § 26 para. 1 sentence 1 BDSG (Bundesdatenschutzgesetz, German Federal Data Protection Act) must be assumed to be contrary to EU law. The lawfulness of processing must therefore be assessed against Art. 6 para. 1 sentence 1 DSGVO, insofar as the scenarios relevant here are concerned.
Consent under Art. 6 para. 1 sentence 1 lit. a DSGVO
Processing may be permissible under Art. 6 para. 1 sentence 1 lit. a DSGVO if the data subject has given consent for one or more specific purposes. The DSGVO imposes strict requirements on valid consent.
Under Art. 7 para. 1 DSGVO, it must be possible to demonstrate that consent was given. Recital 32 requires a clear affirmative act. This must be freely given, specific, informed and unambiguous in expressing that the data subject agrees to the processing of personal data concerning them.
According to Recital 42, the data subject should at least know who the controller is and for what purposes the data are processed. In the employment relationship, voluntariness is the main issue. It is sometimes argued that voluntary consent in an employment relationship is not possible because of the relationship of dependency. This view must be rejected in its absolute form; nevertheless, voluntariness in the employment relationship must always be carefully assessed on a case-by-case basis.
Consent may be withdrawn at any time pursuant to Art. 7 para. 3 sentence 1 DSGVO. The data subject must be informed of this right of withdrawal before submitting the declaration of consent, Art. 7 para. 3 sentence 3 DSGVO.
Legitimate interests under Art. 6 para. 1 sentence 1 lit. f DSGVO
Art. 6 para. 1 sentence 1 lit. f DSGVO is particularly important in practice. Accordingly, processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. However, this applies only insofar as the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not override those interests.
Legitimate interests may include not only legal interests, but also factual, economic and non-material interests of the controller or a third party. The necessity test is followed by a balancing of interests. According to Recital 47 DSGVO, it is particularly relevant in this context whether the data subject could reasonably expect, at the time the data were collected, processing for the relevant purpose.
Works agreement as a possible basis
Art. 88 para. 1 DSGVO allows Member States to provide, by law or collective agreements, more specific rules for the processing of employees’ personal data in the employment context. This concerns in particular purposes of recruitment, performance and termination of the employment relationship, management, planning and organisation of work, equality and diversity in the workplace, health and safety, protection of the employer’s or customers’ property and the exercise of individual or collective rights and benefits related to employment.
The German legislator has made use of this option. Under § 26 para. 4 sentence 1 BDSG, the processing of personal data, including special categories of employees’ personal data, for employment-related purposes is permissible on the basis of collective agreements. Works agreements may therefore, in principle, constitute a legal basis for the processing of employees’ personal data.
In doing so, the negotiating parties must observe Art. 88 para. 2 DSGVO pursuant to § 26 para. 4 sentence 2 BDSG. Accordingly, suitable and specific measures must be provided to safeguard human dignity, the legitimate interests and the fundamental rights of the data subject. This relates in particular to transparency, data transfers within a group of undertakings or a group of enterprises engaged in a joint economic activity, and monitoring systems in the workplace. The level of protection under the DSGVO must not be undercut.
Significance of data protection in restructurings
The principles set out above are relevant in numerous restructuring scenarios. This applies not only to the implementation of the actual transaction, but already to preparatory measures.
Typical examples are:
- preparation of organisational charts and employee lists,
- internal distribution of such documents,
- disclosure to advisers,
- due diligence reviews involving employee data,
- disclosure of personal data to potential purchasers,
- lists of names under § 1 para. 5 KSchG (Kündigungsschutzgesetz, German Protection Against Dismissal Act) in the context of negotiations on a reconciliation of interests,
- preparation and implementation of voluntary redundancy, retirement or partial retirement programmes,
- calculation of severance payments in social plan negotiations.
In all cases mentioned, personal data are processed. For each individual processing operation, it must therefore be examined whether a legal basis exists. The focus below is on corporate transactions and, in particular, due diligence, in which personal data may be transferred to potential purchasers.
Due diligence and disclosure of employee data
The data protection classification depends essentially on which data are disclosed for which purpose, to what extent and to whom. In transactions, a distinction must also be made between whether the transaction is a share deal or an asset deal.
In a share deal, the controller generally remains in place according to the interpretation of the Datenschutzkonferenz (Conference of the Independent Data Protection Supervisory Authorities of the Federation and the Länder), apart from review activities in the context of due diligence. As a result, the processing of personal data is usually less problematic compared with an asset deal. In an asset deal, by contrast, assets and contractual relationships are transferred, meaning that the transfer of data to another controller regularly comes more strongly into focus.
At its interim conference on 11 September 2024, the Datenschutzkonferenz adopted a resolution on transfers of personal data to the purchaser of a company in the context of an asset deal. This resolution replaces the earlier resolution from 2019 and, for certain scenarios, places an opt-out mechanism at the centre of data transfer in asset deals. The predecessor resolution of 24 May 2019 contained a catalogue of case groups for the balancing of interests under Art. 6 para. 1 sentence 1 lit. f in conjunction with Art. 6 para. 4 DSGVO, including customer data in ongoing contracts and customer data in relation to outstanding receivables.
At the 3rd interim conference of the Datenschutzkonferenz on 23 September 2026, by contrast, the focus was on video surveillance in fitness studios and smart glasses; no new resolution on asset deals or restructurings was adopted there.
Consent for transfer to prospective purchasers
Consent is regularly not the preferable means for transferring employees’ personal data to prospective purchasers. The requirements for validity alone are substantial, particularly in the employment relationship. This results in considerable legal uncertainty.
Depending on the number of affected employees, there is also a significant administrative burden. This burden and the legal uncertainty are intensified by the fact that consent can be withdrawn at any time under Art. 7 para. 3 sentence 1 DSGVO. Although withdrawal has effect only for the future, depending on the stage of the transaction process it may nevertheless complicate or at least delay the planned approach.
In transaction practice, there is another factor. The participating companies regularly have an interest in keeping the planned corporate transaction confidential. This confidentiality interest is often in tension with the specific and informed description of data processing required for valid consent.
Works agreement in the case of data transfer to purchasers
In practice, a works agreement also cannot be considered a viable basis for transferring employees’ personal data to potential purchasers. It is already questionable whether Art. 88 para. 1 DSGVO is applicable and whether a works agreement can serve as a suitable basis in this situation at all.
For the employment context within the meaning of Art. 88 para. 1 DSGVO, a direct substantive connection with the contractual purpose of the employment relationships is required. However, the transfer to a potential buyer serves solely that buyer’s interest. The required direct substantive connection therefore does not exist.
In addition, such a works agreement would generally not be tailored to a specific individual case, but would be directed comparatively generally at the disclosure of personal data in the context of due diligence. This is likely to be problematic in the same way as blanket consent. Art. 88 DSGVO permits only more specific rules.
Legitimate interests as the remaining basis
For the disclosure of employees’ personal data to potential purchasers, Art. 6 para. 1 sentence 1 lit. f DSGVO therefore remains the initial legal basis. First, the disclosure of data must be necessary. In relation to the respective category of data, it must not be possible to carry out the due diligence without transferring the relevant data.
Necessity must be examined separately for each data category. At the same time, proportionality must be taken into account. Pseudonymising data, or ideally anonymising them, can contribute to proportionality and to compliance with the principle of data minimisation.
After the necessity test, a balancing of interests must be carried out. The interests of the person affected by the processing must not override the controller’s interests in disclosing the data. The employer can influence this balancing exercise by establishing suitable framework conditions.
The following may be relevant in particular:
- transparent information already at the time the data are collected, for example at the beginning of the employment relationship, that disclosure to potential buyers in the context of due diligence may be considered,
- agreements with recipients on confidential treatment of transmitted data,
- limitation of access to the necessary group of persons,
- use of data rooms,
- restriction to inspection without the possibility of copying, insofar as this is provided for in the specific procedure.
The principle of purpose limitation does not preclude disclosure on the basis of Art. 6 para. 1 sentence 1 lit. f DSGVO. Both processing purposes ultimately serve the continuation of the employment relationship. The processing is therefore permissible under Art. 6 para. 4 lit. a DSGVO.
The guidelines on due diligence reviews published by the Liechtenstein Data Protection Office at the beginning of 2026 likewise identify data minimisation, anonymisation or pseudonymisation and balancing of interests as central requirements. These points correspond to the essential requirements that must also be observed in the context of a data protection assessment under the DSGVO.
Special categories of personal data
For prospective purchasers, particularly protected information may in some cases be of considerable economic significance. Special categories of personal data include, for example, information on trade union membership or severe disabilities.
Such data are subject to the enhanced protection of Art. 9 DSGVO. There is generally no legal basis for their transfer in the context of due diligence. Explicit consent under Art. 9 para. 2 lit. a DSGVO will typically not exist in practice. The other narrow exemptions under Art. 9 para. 2 DSGVO are also generally not applicable.
Nor are the requirements of the opening clause in § 26 para. 3 BDSG met. The transfer is not made for the exercise of rights or the fulfilment of legal obligations under employment law. The consequence is that such data can only be presented as aggregated statistics and, where applicable, supported by contractual safeguards.
Information obligations under Art. 13 and 14 DSGVO
Information obligations are often not sufficiently taken into account in restructurings. Art. 13 and Art. 14 DSGVO require the controller to provide data subjects with certain information about data processing.
The DSGVO distinguishes according to whether the data were collected directly from the data subject or not. Art. 13 DSGVO concerns collection from the data subject. Art. 14 DSGVO concerns cases in which personal data were not collected from the data subject.
Information obligations may therefore apply to both the seller and the purchaser. The purchaser receives personal data without having collected them from the data subjects themselves. The seller may be subject to information obligations if data already collected are further processed for another purpose.
Tension with the confidentiality of the transaction
As with obtaining consent, compliance with information obligations may conflict with the confidentiality interests of the participating companies. Art. 14 para. 5 lit. b DSGVO takes this into account for cases in which the information under Art. 14 para. 1 DSGVO does not have to be provided if doing so would render impossible or seriously impair the achievement of the objectives of the processing.
An exception from the information obligation may therefore be justified for the purchaser. However, this leads to the striking result that, while the purchaser may under certain circumstances not have to provide information, the seller nevertheless remains subject to information obligations.
Art. 13 para. 3 DSGVO provides for an information obligation not only upon initial data collection. It also applies if data are further processed for a purpose other than that for which they were originally collected. Unlike Art. 14 DSGVO, Art. 13 DSGVO contains no corresponding exception.
For this reason, it is sometimes argued that Art. 14 para. 5 lit. b DSGVO should be applied by analogy to Art. 13 DSGVO. However, as long as there is no relevant case law on this point, refraining from providing information on this basis remains risky. The risk can be limited by pseudonymising data as far as possible.
Transparency as a supervisory focus
The importance of transparency and information obligations is also evident at the European supervisory level. On 19 March 2026, the European Data Protection Board launched its Coordinated Enforcement Framework action 2026, which reviews the transparency and information obligations under Art. 12, 13 and 14 DSGVO. 25 supervisory authorities in the European Economic Area are participating in the action. The selection of the topic had already taken place on 14 October 2025 in the plenary session of the European Data Protection Board.
For restructurings, this underscores that information obligations are not merely a formal annex. They are an independent subject of review that can acquire particular significance in transactions and due diligence processes.
Developments in German data protection law
At national level as well, the structures of data protection law are in flux. On 10 July 2026, the Bundesrat (German Federal Council) adopted, at its 1067th session, a draft act amending the Bundesdatenschutzgesetz. The draft was forwarded to the Bundestag (German Federal Parliament) on 26 August 2026 as printed matter 21/7732.
The aim of the draft is to modernise the federal structure of data protection supervision through binding cooperation mechanisms and a bundling of responsibilities. In particular, the draft provides for the statutory anchoring of the Datenschutzkonferenz. The Federal Government adopted an opinion on the Bundesrat draft submitted by the Federal Minister of the Interior.
The draft also takes up the announcement made by the governing parties in early July 2026 to simplify supervisory structures and to bundle them, among other things, by concentrating responsibilities with the Federal Commissioner for Data Protection. According to the Federal Modernisation Agenda of 4 December 2025, the Federation also intends, by 31 December 2026, to introduce the repeal of § 38 para. 1 BDSG and to align the obligation to appoint data protection officers in the non-public sector with Art. 37 DSGVO.
These developments do not change the fact that the substantive requirements of the DSGVO must be complied with in restructurings. However, they show that supervisory structures and enforcement mechanisms continue to be the subject of legislative and administrative development.
Conclusion: classify data protection early as part of the transaction review
In corporate transactions, experience shows that economic, tax, corporate law and financing-related aspects are often at the forefront. Data protection issues can easily take a back seat, particularly under time pressure. Nevertheless, the transfer of personal data in the context of restructurings can have significant legal and economic consequences.
Unlawful processing or unfulfilled information obligations can trigger high fines and possible damages claims by affected persons. This weighs particularly heavily where a large number of employees, customers or business partners are affected. Against this background, the data protection assessment of due diligence processes, data rooms and transfer operations is of considerable importance.
MTR Legal Rechtsanwälte advises companies, investors and high-net-worth individuals on data protection issues in connection with restructurings, transactions and ongoing corporate processes. Anyone wishing to clarify legal questions regarding the processing of personal data in such situations can find further information under Legal advice in data protection law.
