When conducting due diligence during an acquisition, a privacy professional should avoid allowing legal in both companies to handle the privacy laws and compliance. This is because privacy is not only a legal issue, but also a business, technical, and operational issue that requires cross-functional collaboration and expertise.
A privacy professional should be involved in the due diligence process to assess the privacy risks and opportunities of the acquisition, such as the type and scope of data processing, the data protection policies and practices, the data transfer mechanisms and agreements, the data breach history and response plans, and the impacts on the data processing operations post-acquisition. A privacy professional should also benchmark the two companies' privacy policies against one another to identify any gaps or inconsistencies that need to be addressed before or after the acquisition, . References: [CIPM - International Association of Privacy Professionals], [Free CIPM Study Guide - International Association of Privacy Professionals]