Privacy Risk As Transaction Risk: The DPDP Act 2023 And The Repricing Of Data-Rich GenAI Targets in Indian M&A

ABSTRACT

The surge in the use of Generative Artificial Intelligence (“GenAI”) has fundamentally changed the paradigm of value creation in the digital economy. Indian start-ups in the Fintech, health-tech and AI-driven consumer internet space are capital intensive and rely on extensive data sets to train and fine-tune their AI models. At the same time, with the introduction of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), India now has a robust data privacy framework which governs processing of digital personal data. However, the discussion around the impact of the DPDP Act has so far revolved around individual privacy rights and obligations of organisations processing personal data under the DPDP Act. This note seeks to contribute to the discussion by analysing the potential impact of the privacy obligations on valuation, transaction structure and legal diligence in Indian M&A deals involving GenAI-based enterprises.

The note argues that with the DPDP Act, deficiencies in data governance may result in commercial risks beyond regulatory scrutiny in case of data protection violations. These commercial risks could have an impact on deal price, structure and legal diligence in deals involving health-tech and fintech start-ups. By comparing the provisions of the DPDP Act with those of the GDPR, the note concludes that data privacy compliance is increasingly becoming a transaction risk and due diligence in AI-driven deals should be considering beyond regulatory requirements.