A buyer needs to know what personal data the target holds, why, where it sits, who receives it and how long it is kept. GDPR Article 30 gives a ready structure. If the target has no such record, building one is the first privacy task in diligence.
This is a general guide, not legal advice.
The Article 30 structure
For controllers, the record of processing activities must include contact details, purposes of processing, categories of data subjects and personal data, categories of recipients, transfers to third countries with safeguards, envisaged erasure time limits where possible, and a general description of security measures where possible.
Processors keep a shorter record: categories of processing for each controller, transfers and security measures.
Turning it into diligence questions
- What categories of personal data are held for customers, employees and prospects?
- What is the purpose and lawful basis for each?
- Which vendors and affiliates receive it?
- Does any data leave the region where it was collected?
- How long is each category kept, and is deletion actually run?
- What access controls and encryption apply?
Find the data you did not list
Records drift from reality. Check logs, analytics tools, support tickets, backups and test databases cloned from production. Data discovery tooling and a grep for common identifiers across repositories often turn up surprises.
Check the paperwork
Ask for privacy notices, data processing agreements, records of consent where used, and any data subject request log. A log with no entries in a consumer business is itself a question.
What affects the deal
- Data collected without a clear basis may not be usable by the buyer for new purposes.
- Cross border transfers may need new safeguards after close.
- Past breaches may carry notification duties already missed.
Starting with a lightweight map
If no record exists, do not start with a perfect spreadsheet. Draw a map of systems that store personal data: production databases, analytics, support, marketing, HR and backups. For each, note data categories, owner and vendor.
Then interview each owner for twenty minutes with four questions: what data, why, who else gets it and when is it deleted? Capture answers in the Article 30 fields so the map becomes a record.
Check two or three entries against reality. Ask for a sample of the data or run a query. Differences between the record and the systems show how far the record can be trusted.
Keep the output short enough that someone will maintain it. A record nobody updates is out of date within months.
Quick check
Is a record of processing always required?
Article 30 sets exemptions for small organisations, but they are narrow. Check with counsel rather than assuming.
Sources
Last reviewed: 19 October 2026.
