Post-Closing Data Use: The Hidden Integration Risk in Indian AI M&A
Over the last two years, mergers and acquisitions of AI startups in India have increased significantly as M&A is being used as a strategy for companies to scale by acquiring access to data, AI models, talent, and IPR rights or as a shortcut to setting up a Global Capability Center (GCC). As per data from Venture Intelligence reported in The Economic Times, the deal value as of August 2026 was nearing the USD 1 billion mark.[1]
However, as per a Crisil review, only two in three of debt-funded deals met the intended business outcomes with integration challenges accounting for half the cases.[2] A critical legal issue affecting integration is whether, post-acquisition, the target’s data can actually be used for the purposes contemplated by the acquirer when valuing and structuring the transaction. More specifically, the question becomes whether the buyer is acquiring an AI asset whose training data, customer data and improvement rights can legally continue to be exploited post-closing.
What Does the DPDP Act Actually Permit?
India’s data protection law, known as the DPDP Act, links consent to specified purposes. Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, and the consent must signify agreement to processing for the specified purpose. Section 5 correspondingly requires the notice to identify the personal data and the purpose for which it is proposed to be processed.
The DPDP Act contains no general M&A exception permitting an acquirer to inherit or repurpose personal data simply because the data forms part of the acquired business. This matters in the context of an M&A deal where the economic rationale for the acquisition itself may depend on uses of the data that the target itself never made.
Section 17(1)(e) of the DPDP Act does contain an M&A exemption. It disapplies most of Chapters II and III of the Act where processing is necessary for a merger, amalgamation, demerger, reconstruction or transfer of undertaking approved by a court, tribunal or other competent authority. However, the exemption appears limited to processing necessary to effect the transaction. It does not provide an independent basis for subsequent processing by the buyer for its own commercial purposes once that processing is no longer necessary for the transaction itself.
Moreover, Section 17(1)(e) is drafted around specified forms of restructuring requiring approval under Indian company law. A normal private share acquisition of an AI startup may not fall within it at all if approval of the transaction by a court or tribunal is not required.
The DPDP Act facilitates the processing of personal data necessary to execute certain M&A transactions, but does not expressly address the legal status of the acquired dataset after completion. For AI acquisitions, this creates a gap between acquiring the company that holds the data and acquiring the legal ability to exploit that data for the buyer’s AI systems.
When Purpose A Becomes Purpose B
Suppose a European buyer values an Indian AI target partly because its customer dataset can be combined with the buyer’s existing data or the target’s data can be fed into the buyer’s AI models for use across the buyer’s group worldwide. The target may itself have validly collected and processed that data for purpose A but the business rationale for the acquisition assumes post-closing use B. Therefore, although the identity of the Data Fiduciary may not change in a simple acquisition of shares, the buyer’s intended post-acquisition use of the data may change substantially. This is not only a compliance issue but one that goes directly to valuation. Due diligence cannot stop at whether the target lawfully collected the data. The buyer needs to determine whether the purposes for which that data may lawfully be processed encompass the uses on which its valuation of the target is based.
One may ask, “what if we anonymise the dataset?” As the DPDP Act applies to digital personal data, the possibility of anonymisation potentially changes the analysis. But this raises a commercial question peculiar to AI acquisitions: can the data be anonymised sufficiently to take it outside the DPDP Act without simultaneously removing attributes that made the dataset valuable for training?
From Data Due Diligence to Deal Architecture
If diligence identifies that the buyer cannot safely make its intended post-closing use of the dataset, the consequences may extend to purchase-price adjustments, covenants to obtain fresh consents, restrictions on combining datasets and the sequencing of post-closing integration. In an AI acquisition, data protection due diligence can therefore affect not merely the warranties but the deal architecture, post-closing integration and potentially even whether the acquisition should proceed.
Aparna Viswanathan
Managing Partner
Viswanathan & Co., Advocates
[1] “AI M&As are through the Roof this year with Deals Nearing $1b Mark,” The Economic Times, August 14, 2026.
[2] “Indian companies step up acquisitions for AI, Technology and Talent: Crisil,” The Economic Times, September 11, 2026.
