Privacy in M&A: Getting Acquisition-Ready
May 12, 2026
In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Gabe Maldoff, a partner in Goodwin’s Data, Privacy, and Cybersecurity practice, about privacy in mergers and acquisitions Together, they discuss why startups and fast-growth companies should address privacy early, how to navigate privacy due diligence without derailing deals, and how clear confident answers about data practices can help build trust during a transaction.
In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Gabe Maldoff, a partner in Goodwin’s Data, Privacy, and Cybersecurity practice, about privacy in mergers and acquisitions. The conversation explores why investment rounds and acquisitions often become forcing factors for privacy maturity, especially for startups and fast-growth companies preparing for their next stage of growth.
The discussion covers what sellers should prepare before due diligence, how privacy representations work in transaction documents, when disclosure is legally required versus strategically useful, and why the way a company explains its privacy posture can matter as much as any underlying issues.
What this episode covers:
- Why investment rounds and acquisitions can drive privacy maturity
- How uncertainty around data practices creates deal friction
- The difference between required legal disclosures and strategic disclosures
- Why buyers often evaluate security incidents based on the quality of the response
- Why AI representations and vendor diligence are becoming more important in deals
- How data governance, privacy notices, and recordkeeping can support acquisition readiness
- Three practical steps companies can take today to better position themselves as acquisition-ready
And so much more!
Connect with Gabe Maldoff here: LinkedIn
Connect with Kellie du Preez here: LinkedIn
Connect with Danie Strachan here: LinkedIn
If you enjoyed this episode, make sure to subscribe, rate, and review it.
Episode Highlights:
- [05:20] The Biggest Privacy Deal Breakers
The issue is not necessarily the existence of privacy gaps. More problematic is not knowing they exist. Buyers can price risk, but they can’t price uncertainty. Transparency and self-awareness beat perfection every time.
- [20:47] Security Incidents: What to Disclose and How
Many companies will face an incident eventually. What matters most is the quality of the response, including proper investigation, the right advisers, and taking ownership. A big breach handled well raises fewer red flags than a small one handled poorly.
- [34:21] The Most Valuable Privacy Investment You Can Make
Not every company needs a CPO, but every company needs someone who owns privacy. The right person drives milestones, communicates risk to executives, and brings the calm confidence that buyers look for. People are the single most lucrative investment in privacy.
- [46:04] Three Things You Can Do Today to Be Acquisition-Ready
Buyers are not looking for perfection. They are looking for signs of operational maturity, accountability, and trustworthiness. We explore several areas that can have an outsized impact on how companies are evaluated during diligence.