New playbook aims to influence industry-wide approach to data privacy in M&A

New playbook aims to influence industry-wide approach to data privacy in M&A

Prosus recently published its privacy playbook for M&A transactions, reinforcing the group’s commitment to data protection and privacy.

Data privacy is a key consideration in M&A activities. However, unlike employment or IP, there are few well-established precedents for the treatment of data privacy matters in an M&A context.

This new playbook, which offers insights and best practices, aims to give both M&A and privacy teams the means to enrich their knowledge, identify privacy-related issues, and better navigate the M&A process from a data privacy perspective.

Let’s look at how this document came about and what it aims to do.

Data privacy comes of age

Across companies within the Prosus Group, data privacy has become an increasingly important issue over recent years. While some M&A specialists within the group had considerable knowledge and expertise on relevant data privacy issues, that knowledge base and experience was not consistent globally, explained Marcin Czarnecki, Senior Privacy Counsel at Prosus Group, and lead author of the document. “The same is generally true for different privacy team members’ understanding of M&A processes because each has a different level of exposure to the field depending on the stage of their career and the company they represent.”Marcin Czarnecki

This project came about partially as a result of Czarnecki’s particular career path; when he joined Prosus four years ago, he had been a legal specialist in M&A for the tech sector. During and immediately after the job transition was, as he puts it, “a really interesting time in data privacy, with global developments in the field, such as GDPR and the California Consumer Protection Act, South Africa's Data Protection Act and Brazil's privacy law, the LGPD.”

He found himself at a unique vantage point. “As I was working at a high level on multiple acquisitions across different segments in our group, I saw that there were some areas where people had an advanced understanding of data privacy, and importantly, what could be applied to benefit other segments.” This was the beginning of the playbook creation process.

Asking the right questions is everything

The key to data privacy – and indeed this playbook – is questions. This is according to Justin B. Weiss, the Global Head of Data Privacy at Prosus and Naspers, who co-authored the playbook with Czarnecki. “This document is part of our ongoing contribution to what responsible investing should mean,” he explains.

The digital space is complicated and heterogeneous, with diverse stakeholders and diverse rules and regulations across different jurisdictions. The one solution that can sort out priorities and processes, Weiss points out, is questions: “It comes down to this: What questions do we need to be asking in an M&A process, and at what time are certain questions appropriate and constructive? Everything follows from that.”

Weiss goes on to list some examples of where data privacy can be a material concern in transactions: data breach and ransomware risks, data subject rights management, GDPR-compliance, international data transfers, data localisation, consent for data sharing, and privacy issues specific to minors or other vulnerable populations. "To support our portfolio of companies, we have developed an alertness to the impact of these topics on our business and investment theses."

The questions are there, but only if you know what to ask, to whom, and when. And that’s where the data privacy playbook comes in.

As Weiss puts it, "This document is about cross-training our teams, not just to ask better questions, but to ask the questions at the right time to the right stakeholder." The future, as he sees it, is in cross-disciplinary collaboration.

And this playbook helps Prosus consolidate the learnings and put them in one place, for ease of use, and to raise the overall level of expertise within the group. But the impact won’t stop there.

A rising tide raises all boats

For Prosus, part of responsible investment means having a positive influence on the technology industry as a whole, thus creating a more responsible suite of economic activities. "We decided not to keep this playbook as proprietary,” Weiss says. “Better data privacy isn't a secret recipe or special sauce that we want to keep to ourselves, we want to share it.”

Weiss is on the board of the International Association of Privacy Professionals (IAPP), a grouping of 70,000+ global members, and he sees a demand for knowledge sharing via this playbook. So, in addition to its use internally, a global roll-out, via the IAPP, is in the works.

Both Weiss and Czarnecki see this work as establishing a baseline. The next step, according to them, is a rate card, where estimated costs associated with data privacy considerations and actions can be collected and forecasted into M&A activity.

"I don't see the publication of this document as the end, it's the beginning of an ongoing process that can substantially boost the expertise and ability of companies to bake data privacy into their M&A activities," Weiss explains.

And the playbook’s greatest value? According to Czarnecki, it’s that "this document takes a nuanced understanding of how data privacy fits into M&A practise and makes it accessible and actionable."

Download a copy of the ‘Privacy in M&A transactions playbook’ here.


About Prosus:

Prosus is a global consumer internet group and one of the largest technology investors in the world. Operating and investing globally in markets with long-term growth potential, Prosus builds leading consumer internet companies that empower people and enrich communities.

The group is focused on building meaningful businesses in the online classifieds, food delivery, payments and fintech, and education technology sectors in markets including India and Brazil. Through its ventures team, Prosus invests in areas including health, logistics, blockchain, and social commerce. Prosus actively seeks new opportunities to partner with exceptional entrepreneurs who are using technology to improve people’s everyday lives.

Every day, billions of customers use the products and services of companies that Prosus has invested in, acquired or built, including 99minutos,  Airmeet, Aruna, AutoTrader, Autovit.ro, Azos, BandLab, Bibit, Bilt, Biome Makers, Borneo, Brainly, BUX, BYJU'S, Bykea, Captain Fresh, Codecademy, Collective Benefits, Creditas, DappRadar, DeHaat, Detect Technologies, dott, EduMe, ElasticRun, eMAG, Endowus, Eruditus, EVERY, Facily, Flink, Foodics, Good Glamm Group, GoodHabitz, GoStudent, Honor, iFood, Imovirtual, Klar, Kovi, LazyPay, letgo, Luno, Mensa Brands, Meesho, merXu, Movile, Oda, OLX, Otodom, OTOMOTO, Oxford Ionics, PaySense, PayU, Pharmeasy, Platzi, Property24, Quick Ride, Red Dot Payment, Republic, Sharebite, Shipper, ShopUp, SoloLearn, Stack Overflow, Standvirtual, Superside, Swiggy, Thndr, Tonik, Ula, Urban Company, Vegrow, Virgio, watchTowr, and Wayflyer.

Hundreds of millions of people have made the platforms of Prosus’s associates a part of their daily lives. For listed companies where we have an interest, please see: Tencent, Delivery Hero, Remitly, Trip.com, Udemy, Skillsoft, and SimilarWeb.

Today, Prosus companies and associates help improve the lives of more than two billion people around the world.

Prosus has a primary listing on Euronext Amsterdam (AEX:PRX) and secondary listings on the Johannesburg Stock Exchange (XJSE:PRX) and a2X Markets (PRX.AJ). Prosus is majority-owned by Naspers.

For more information, please visit www.prosus.com.

About Prosus

Prosus is a global consumer internet group and one of the largest technology investors in the world. Operating and investing globally in markets with long-term growth potential, Prosus builds leading consumer internet companies that empower people and enrich communities.

Read More

Media contacts

General enquiries
+ 27(0)21 406 2121
Press office
[email protected]
Investor relations
[email protected]