Navigating GDPR challenges in M&A transactions: Practical insights from the Italian legal framework

Tommaso Zeccherini
Additional contact information
Tommaso Zeccherini: Deloitte Financial Advisory, Italy

Journal of Data Protection & Privacy, 2025, vol. 8, issue 1, 54-64

Abstract: Mergers and acquisitions (M&A) involving business unit transfers present significant data protection challenges, requiring compliance with the General Data Protection Regulation (GDPR) and national laws. This paper examines the practical obligations of data controllers transferring business units in Italy, considering Italian Civil Code and GDPR requirements. The paper provides a structured approach to ensuring compliance in business transfers, covering key obligations such as data minimisation, privacy notice requirements, legal basis identification, legitimate interest assessments, data processing agreements (DPAs) and security measures for data transfers. The analysis integrates key decisions from the Italian Data Protection Authority along with practical business cases from the banking sector, offering insights into regulatory expectations and enforcement trends. By bridging legal principles with practical implementation, this paper serves as a strategic guide for businesses, legal professionals and policy makers navigating data protection in M&A transactions. The paper concludes with recommendations for best practices in handling personal data during corporate restructuring and acquisitions, ensuring compliance while mitigating legal and operational risks. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.

Keywords: GDPR; data protection; mergers and acquisitions; business unit transfer; Italian law; compliance strategies (search for similar items in EconPapers)
JEL-codes: K2 (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/9810/download/ (application/pdf)
https://hstalks.com/article/9810/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:jdpp00:y:2025:v:8:i:1:p:54-64

Access Statistics for this article

More articles in Journal of Data Protection & Privacy from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().