Buying Beyond the Border

Acquiring a company outside the United States means inheriting whatever cybersecurity gaps and privacy obligations the target never fixed, not just its balance sheet. This article walks through what buyers need to check before signing, negotiate before closing, and remediate after the deal, with a specific look at how the rules shift once the target sits in Canada, Mexico, or Europe.

It is simple, whatever the acquisition target has failed to fix, you now own. That includes breaches that have already happened but haven't been discovered, contractual commitments to customers about data handling, and the regulatory exposure attached to every record the target holds. Successor liability means fines, notification duties, and remediation costs can follow the asset across the closing table. 

For domestic deals this is well understood, but for cross-border deals, three things get harder: 

1. The applicable law is frequently the target's, not the buyer's. A U.S. company can become directly subject to European or Canadian privacy regimes the moment it takes control. 
2. Security breach notification triggers and timelines differ by jurisdiction, so a playbook built for U.S. state laws will misfire abroad. 
3. Data almost always moves across borders during integration, and those transfers are themselves regulated. 

Getting any of these wrong turns an investment into a liability. 

Traditional M&A due diligence often focuses on financial statements, contracts, tax exposure, employment matters, litigation, and commercial strategy. Cybersecurity due diligence needs to be treated with the same seriousness. At a minimum, the buyer should assess the target’s: asset inventory, identity and access management, endpoint controls, cloud security, network segmentation, vulnerability management, encryption, logging and monitoring, incident response maturity, backup and recovery capabilities, software development lifecycle, and third-party risk program. 

This is especially important in cross-border deals because regulators may judge the buyer’s post-closing conduct based on how quickly it identified and remediated known or knowable weaknesses. 

On the other hand, Data Privacy compliance is often the highest-risk area in an international acquisition because personal data may be central to the target’s business model. Customer databases, loyalty programs, marketing lists, HR systems, telemetry, analytics data, and support tickets can all trigger legal obligations. Before closing, the buyer should understand what data is collected, where it is stored, whether it includes sensitive data, what legal bases or consents support processing, what privacy notices were given, which vendors process the data, how long data is retained, and whether cross-border transfer mechanisms are valid. 

The buyer should also assess whether the transaction itself changes the purposes for which personal data will be used. For example, if a Canadian, Mexican, or European company collected personal data for one purpose, and the U.S. acquirer intends to combine it with U.S. datasets for advertising, AI training, fraud analytics, or centralized customer profiling, that may require updated notices, consent analysis, data protection impact assessments, transfer impact assessments, or limits on use. 

At the federal level, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs personal information data collection, use, and disclosure in the private sector. It has mandatory reporting of breaches posing a "real risk of significant harm" to the Office of the Privacy Commissioner since 2018. 

Several provinces like Alberta, British Columbia, and Quebec, maintain their own laws deemed substantially similar, so the governing rules depend on where the target operates and where its customers live. 

Quebec's Law 25, formerly Bill 64, is the one that most directly touches M&A. Phased in through 2024, it introduces GDPR-style enforcement mechanisms, with administrative fines reaching up to $25 million CAD or 4% of global turnover, whichever is higher. A buyer that treats a Quebec target like any other Canadian target can miss a step that is legally required to complete the deal cleanly. 

Due diligence considerations for targets operating in Quebec include: 

Mexico should not be treated as a low-compliance jurisdiction. Mexican private-sector data protection law is built around the Federal Law for the Protection of Personal Data Held by Private Parties, commonly referred to as LFPDPPP. 

For a U.S. buyer, Mexican diligence should focus heavily on privacy notices, consent, data transfer clauses, vendor management, employee data, customer data, and breach notification practices. Mexican privacy rules emphasize transparency through the “Aviso de Privacidad”, the Privacy Statement, and data subjects have rights that must be operationalized. 

In M&A, the acquirer should confirm whether the target’s privacy notices permit transfers connected to a merger, acquisition, restructuring, or change of control. If they do not, the buyer may need a remediation plan before data is migrated into U.S. systems or group-wide platforms. Mexico’s data protection regime also emphasize that affected individuals must be notified directly of certain personal data breaches, and that cross-border transfer and accountability obligations must be assessed. 

The new LFPDPPP repeals the 2010 law and introduces stringent operational requirements that fundamentally alter how due diligence must be conducted for Mexican targets. Acquirers must assess companies against these updated standards: 

The European Union operates the most mature and aggressively enforced data protection regime globally. For an acquirer purchasing a European target, the regulatory landscape is dominated by the General Data Protection Regulation (GDPR), supplemented by sweeping new directives targeting critical infrastructure and digital operational resilience. 

A U.S. buyer acquiring a European company must evaluate GDPR roles, legal bases, consent validity, data subject rights, retention schedules, processor agreements, records of processing, cross-border transfer mechanisms, breach history, and supervisory authority correspondence. GDPR international transfer rules are particularly important because moving data from an EU target to U.S. parent systems, support teams, data lakes, security tools, or cloud environments can trigger Chapter V requirements. 

The most prominent event defining M&A liability under the GDPR is the enforcement action against Marriott International following its acquisition of Starwood Hotels and Resorts. In 2016, Marriott acquired Starwood. Unbeknownst to Marriott, Starwood's IT systems had been compromised by a cyberattack beginning in 2014. Marriott did not discover the breach until September 2018, over two years after closing the acquisition. The UK's Information Commissioner's Office (ICO) proposed a staggering £99.2 million fine against Marriott. The fine was ultimately reduced to £18.4 million, but the legal precedent set by the ICO was severe. 

Besides GDPR, buyers should also determine whether an European target falls under sector-specific cybersecurity regulations and requirements, such as:

A strong acquisition playbook should include cyber and compliance workstreams before signing, between signing and closing, and after closing.

Echelon Risk + Cyber supports buyers across the full M&A lifecycle, and the value comes from how the firm's five service lines work together rather than in isolation. The table below maps the deal phases exposed to cross-border risk to the capabilities that address them.