Be ready before the buyer goes looking
If you’re raising investment or selling, someone is about to examine your business more closely than anyone ever has. Their job is to find reasons to pay less, hold money back, or load you with warranties. Your job is to give them as few as possible.
The data side of that examination is where a lot of good businesses come unstuck. Not because they’ve done anything wrong — because nobody’s ever asked them to prove how they handle data, and the gaps only surface under a spotlight.
I help you find those gaps first, fix what’s fixable, and walk into due diligence with the data protection and information governance side of your house already in order.
Why the data workstream matters more than people expect
Buyers and investors used to wave data protection through. They don’t anymore.
A modern due diligence process digs into how you handle personal data — what you hold, whether you’re allowed to hold it, whether your contracts cover it, and whether the customer database they’re paying for is actually theirs to use. When the answers are unclear, it shows up in the deal three ways:
The price drops. Unquantified risk is treated as cost. A gap the buyer can’t size becomes a discount they can.
The warranties pile up. What you can’t evidence, you end up promising — personally, in writing, with money behind it. Data protection warranties and indemnities in a share purchase agreement are where today’s loose ends become tomorrow’s liabilities.
The deal slows, or stalls. Every unanswered data question is a query that goes back and forth between lawyers at your expense. Enough of them and momentum — the thing that gets deals over the line — drains away.
And occasionally the asset itself is the problem. If your marketing list was built without a lawful basis, an acquirer may not be able to use it. The thing you thought you were selling quietly loses its value.
What I check — before they do
I run the same examination a buyer’s advisers will run, on your side of the table, while there’s still time to fix things.
- Your compliance posture — records of processing, lawful bases, privacy notices, ICO registration. The documentation a buyer expects to exist, and usually finds doesn’t.
- Your contracts — data processing agreements with suppliers and sub-processors, and whether the chain actually holds together.
- International transfers — the right safeguards in place for any data that leaves the UK, properly documented.
- Your track record — breach history and how it was handled, subject access request handling, any backlog or open complaints.
- Marketing and consent — whether your customer and prospect data can lawfully be used by you now, and by an acquirer later.
- Retention and security — what you keep, for how long, who can reach it, and the obvious gaps a buyer’s technical reviewers will pick up.
- The data assets themselves — whether the databases central to the deal are clean, documented, and lawfully transferable.
You get a clear findings report: what’s solid, what’s exposed, and a prioritised list of what to fix before the data room opens.
What I then help you do
Finding the gaps is only half of it.
Fix what’s fixable. I’ll help you close the gaps that can be closed in the time you have — the missing agreements, the out-of-date notices, the registrations, the records.
Document what can’t be. Some things won’t be perfect by completion. Far better that you surface and frame them than the buyer discovers them. A known, documented, sized issue is a negotiating position. A surprise is a price chip.
Build the data room pack. The evidence buyers ask for, assembled and organised in advance so the data protection section of due diligence is a quick tick rather than a drawn-out chase.
Hold the line during DD. When the questions come in, I can sit in the workstream and answer them — keeping the data protection queries moving so they don’t become the thing holding up your deal.
What this is, and what it isn’t
I’ll be straight about scope, because the wrong expectation helps no one.
This is the data protection and information governance workstream of due diligence — the part I know inside out, having sat on both sides of the table. It is not your financial audit, your tax structuring, or the legal work on the share purchase agreement itself. You’ll have a corporate lawyer and an accountant for those, and they should.
What I do is make sure the data and compliance slice doesn’t become the thing that costs you. Where it touches the wider deal, I’ll work alongside your advisers and point you to the right specialist when something falls outside my lane.
How I work
Scoped, then fixed. We agree what the review and support covers, and I give you a fixed price before you commit. In a live deal the last thing you need is an open-ended invoice.
Plain English, under pressure. Deals move fast and get tense. You’ll get findings and answers you can act on immediately, without having to decode them first.
Discreet. This is sensitive work, often before anyone outside a small circle knows the business is in play. I treat it accordingly.
On your side of the table. My job is to protect your position — your valuation, your terms, your peace of mind through a process that’s stressful enough already.
Where this connects
Due diligence readiness is data governance with a deadline and a buyer attached. If you’ve got time before any process begins, a data governance project gets the foundations clean early, when it’s cheapest. If a deal is already moving, this is the focused, deal-ready version.
And if the business will keep handling data after the deal completes, my DPO as a Service tiers can carry the compliance forward — for you, or for the new owners.
Start before you need to
The best time to prepare for due diligence is well before anyone’s looking. The second best time is now.
Tell me where you are — exploring a raise, fielding interest, or already in a process — and I’ll tell you honestly what the data side of your readiness looks like and what’s worth doing before the spotlight comes on.
No pitch, no obligation. Just a straight read on where you stand.