After the Signing: A Thirty-Day Data Governance Review for UK Acquisitions

Completion of a UK acquisition is often treated as the point at which diligence ends. In data governance terms it is the point at which inherited risk becomes operational. The data room may have disclosed a record of processing activities, a retention schedule and a set of data-sharing agreements, but disclosure is not assurance. Documents may be incomplete, outdated or inconsistent with practice. The first thirty days determine whether those gaps are identified and owned or allowed to become integration debt.

This briefing sets out a practical checklist for UK buyers. It assumes the transaction has completed and that the buyer now controls, or shares control of, the acquired organisation's data estate. It is not a substitute for legal advice, and it should be read alongside the warranties, disclosure letter and any transitional services agreement.

Days 1 to 5: Secure the inherited record

The first task is to establish what has been inherited. Request the current record of processing activities, information asset register, retention schedule, data protection impact assessments, breach log, subject access request log, ICO correspondence and the register of data-sharing agreements. Ask for the DPO's most recent report to the board or equivalent governance forum.

Confirm the DPO's position early. Independence is not a formality. Check the reporting line, whether the DPO has access to the board, whether the role is combined with conflicting responsibilities and whether resourcing is adequate. A DPO who reports to the head of marketing or IT operations may not be able to provide the challenge the role requires.

Do not delete or suspend records merely because they look redundant. Preservation may be necessary for completion accounts, legal claims or regulatory enquiries. Confirm any legal holds and ensure the integration team understands them.

Days 6 to 10: Map assets and flows against the record

Reconcile the record of processing activities against actual systems. This is where inherited estates most often diverge from documentation. Look for local spreadsheets, legacy databases, marketing lists, shared drives and software procured outside central IT.

Map the principal flows: collection, internal sharing, third-party sharing, intra-group transfers and transfers outside the UK. Identify special category data and criminal offence data. For international transfers, confirm the mechanism in use and whether it remains valid after the change of control.

Days 11 to 15: Test retention, lawful basis and marketing permissions

Sample retention compliance across the main systems. Identify records kept beyond schedule, records with no schedule and deletion that cannot be evidenced. Inherited retention schedules often contain rules from predecessor organisations that were never reconciled.

Review the lawful basis for material processing activities. A change of control does not automatically invalidate the basis, but it may change the controller, the purposes or the disclosures. Check whether privacy notices remain accurate and whether consent records, where relied upon, are recorded to the standard required.

For electronic marketing, review permissions and suppression lists against PECR. Inherited marketing databases are a common source of complaint and enforcement risk.

Days 16 to 20: Review regulatory correspondence and incidents

Obtain all correspondence with the ICO, including enquiries, complaints, audit reports, reprimands and any outstanding actions. Review the breach log and subject access request log for backlog, repeat issues and unresolved complaints.

Assess whether any matter requires notification or updating. The buyer should not assume that a pre-completion incident is closed simply because it was disclosed. Check whether remedial actions were completed and evidenced.

Days 21 to 25: Review contracts and third-party arrangements

Review data-sharing agreements, processor contracts and joint controller arrangements. Check change-of-control clauses, audit rights, security schedules, sub-processor approvals and termination assistance. Identify agreements that have not been reviewed since signing or that no one in the acquired organisation now owns.

Where services are provided under a transitional services agreement, confirm who is controller and processor for each activity, and how subject rights and breach notification will operate during the transition.

Days 26 to 30: Integrate findings into the plan

Consolidate findings into a single risk register with owners, deadlines and evidence requirements. Separate immediate containment actions from remediation projects. Immediate actions may include restricting access, correcting privacy notices, suspending unnecessary sharing or appointing interim owners.

Report to the integration steering group or board. The report should state what is known, what is uncertain and what is being done. Avoid presenting every gap as a crisis; prioritise by legal exposure, affected individuals and operational dependency.

Keeping the transaction on track

The purpose of the thirty-day review is not to reopen the deal. It is to ensure that inherited governance risk is managed with the same discipline as financial and operational integration. The buyer that maps the estate, tests the record and assigns ownership in the first month is better placed to avoid surprises in the first year. Due diligence beyond the data room is not a second transaction; it is the beginning of stewardship.