Respecting Boundaries: How can you navigate Privacy Law Challenges and Data Access Limitations in Due Diligence?
In the world of due diligence, accurate, comprehensive information is paramount. Whether evaluating a potential business partner, assessing a company’s financial health, or uncovering potential legal risks, access to information is the foundation of informed decision-making. However, as privacy laws evolve globally, what was once easily accessible is increasingly being protected by strict regulations, posing significant challenges for due diligence professionals.
The growing patchwork of privacy regulations around the world, such as the EU’s General Data Protection Regulation (GDPR), the United States’ state-level laws like the California Consumer Privacy Act (CCPA), and Asia’s emerging regulations like China’s Personal Information Protection Law (PIPL), means that access to certain data—once considered “public”—is now restricted. Even in jurisdictions like the United Arab Emirates, where privacy laws are tightening, information that was previously available through public channels is becoming harder to obtain (see Federal Decree-Law No. 45 of 2021 on Personal Data Protection).
For due diligence professionals, this raises a critical question: What happens when we simply cannot access certain information?
Redefining “Public” Information
Due diligence often relies on information that is traditionally considered public, such as corporate registries, property records, and court filings. These have served as critical resources for verifying company details, uncovering ownership structures, and assessing financial and legal risks. But as privacy regulations evolve, the definition of “public” information is being redefined.
Let’s take the UAE as an example:
- Corporate Records: What was once easily accessible, like shareholder details or beneficial ownership information—may now be restricted or require a government-issued permit.
- Court Filings and Case Records: What used to be open to the public may now be anonymised or blocked under new data protection frameworks.
- Property Registries: Even personal details within property records may be protected under emerging privacy laws, making it harder to verify ownership or asset details.
When Access is Denied: What Comes Next?
So, what happens when due diligence professionals are faced with restrictions on accessing traditional sources of information? The inability to access certain data does not mean the investigation has to end—it simply means adapting to what is legally permissible.
Here’s what professionals can do when access is restricted:
1. Pivot to Alternative, Permissible Sources
When access to traditional records is blocked, it’s time to get creative with alternative sources that are still legally accessible:
- Public Announcements and Disclosures: Companies often disclose material events, financial results, or board changes in press releases or annual reports.
- Industry Reports and Regulatory Filings: Depending on the jurisdiction, industry publications and specific regulatory bodies may provide useful insights into a company’s operations.
- Local News and Media: Regional news outlets or investigative journalism can sometimes provide context or expose issues that are not captured in official documents.
- Interviews and Open-Source Research: Engaging in interviews with industry experts, local stakeholders, or even conducting research across open sources can help uncover insights that may not be available in official records.
2. Focus on Risk Indicators
When direct access to certain information is blocked, the next step is to focus on identifying red flags and risk indicators:
- Reputation Risks: Search for evidence of litigation, regulatory actions, or negative media coverage that could indicate potential issues.
- Financial Signals: Even without full access to financial records, trends in publicly available financial filings or stock market reports can provide useful insights.
- Operational Transparency: Investigate how transparent a company is in its available documentation—lack of clarity may be an indicator of deeper risks.
3. Engage Local Experts
Local legal counsel or investigators familiar with the jurisdiction’s privacy laws can be invaluable. They can:
- Help clarify what information is legally accessible and how to approach these restrictions.
- Suggest alternative methods of gathering data within the boundaries of local laws.
- Serve as intermediaries for obtaining records or information that can legally be accessed.
4. Document the Limitation
Transparency is essential when you face restrictions. Clearly document:
- Which privacy laws or regulations are blocking access to information?
- The specific steps taken to attempt access to the restricted data.
- The impact these limitations have on the overall investigation, including what information is unavailable and how it could affect risk assessments.
Providing this documentation not only helps protect your firm from potential legal exposure but also demonstrates your commitment to maintaining the integrity of the due diligence process.
5. Communicate Risks to Clients
When certain information is inaccessible, it’s crucial to set clear expectations with clients. Explain the limitations and how these affect the investigation, ensuring they understand the potential impact on their decision-making. This openness helps maintain trust with clients and reinforces the importance of compliance.
6. Leverage Global Databases (When Permissible)
Global databases and platforms—such as Orbis, World-Check, or LexisNexis—aggregate public records from multiple jurisdictions. These platforms can provide data that is legally accessible within privacy regulations and can help fill gaps where direct access is restricted. However, it’s important to confirm that the data is compliant with the relevant privacy laws of the jurisdictions you are investigating.
Ethical Challenges: Avoiding the “Loophole” Mindset
It’s important to emphasise that when privacy laws impose restrictions, they are not obstacles to bypass; they are legal boundaries that must be respected. While the temptation to exploit grey areas or loopholes may arise, doing so could lead to serious legal and ethical consequences for your firm.
For example:
- Third-Party Vendors: Relying on unverified third-party vendors or sources that may obtain data through questionable means can expose your firm to significant risk, both legally and reputationally.
- Unregulated Databases: Using databases that circumvent privacy laws can result in inaccurate or illegally obtained information, which undermines the integrity of the investigation.
- Misrepresentation: Attempting to gain access to restricted records by posing as a legitimate or authorised party is a clear violation of the law and could result in severe penalties.
At the core, compliance is not just about avoiding legal penalties—it’s about maintaining the trust of your clients, stakeholders, and the public.
TenIntelligence Thoughts: Upholding Integrity in a Changing Landscape
The restrictions on accessing information due to evolving privacy laws present unique challenges for due diligence professionals. However, these limitations should not be viewed as barriers, but as an opportunity to demonstrate a commitment to ethical conduct, transparency, and compliance. By focusing on permissible sources, identifying risk indicators, engaging local experts, and maintaining clear communication with clients, professionals can still conduct thorough, effective investigations even in the face of privacy restrictions.
In the end, the integrity of the due diligence process is not just about the data you uncover—it’s about how you navigate the legal and ethical boundaries to uncover that data. Respecting privacy laws, even when access is limited, ensures that due diligence remains a trusted and effective tool in making informed business decisions.
To learn more about how to navigate different jurisdictions and privacy laws, please connect with our experts.
Written by
Riwa Haidar | Senior Analyst