Next-Generation Due Diligence Self-Study Webinar

To educate CPAs and financial professionals on how to navigate next-generation risk considerations during M&A due diligence, with a specialized focus on cybersecurity, data privacy, and post-closing integration mechanics.

DETAILED LEARNING OBJECTIVES

• Explain how transaction structure affects the transfer of historical privacy and cybersecurity liabilities

• Identify legal considerations when personal data is transferred as part of an asset acquisition

• Evaluate privacy and regulatory exposure based on the volume and sensitivity of personal data processed

• Develop a privacy and cybersecurity due diligence questionnaire tailored to the target’s risk profile and transaction structure

• Explain why personal information shared during due diligence should follow confidentiality and data-minimization principles

• Identify risks associated with missing or outdated vendor data-processing agreements

• Distinguish structural privacy risks from issues that can be readily remediated

• Evaluate privacy and cybersecurity findings based on their likelihood, potential impact and remediability

• Explain how disclosure of a known issue may qualify a seller’s warranty and affect available deal protections

• Describe the actions parties should take when a significant cybersecurity incident occurs between signing and closing

• Deal structure and scope
  – Privacy and cybersecurity diligence
  – Profile and regulatory exposure
• Initial DDQs and how to share them
• Key diligence areas, common findings, and risks
  – Deal structure’s effect on focus
• Warranties and SPA provisions
• Typical privacy and cybersecurity warranties
  – Disclosure against warranties
• Issues between signing and closing
• Post-closing actions
  – Notices and re-papering

Stanton Burke, Associate Attorney, Gibson Dunn

Stanton P. Burke, CIPP/E, CIPP/US, is a senior associate in the Privacy, Cybersecurity, Data Innovation, and Artificial Intelligence Practice Group. 

He advises clients on global privacy compliance, AI governance, AdTech, consumer protection, cybersecurity, and data-driven transactions – helping product, legal, and engineering teams translate evolving data protection and AI laws into product strategy and practical business decisions. His practice spans compliance counseling, transactional diligence, regulatory response, and incident response – advising clients whether they are launching a new product, evaluating a target's data practices in an acquisition, responding to a regulator or class action, or navigating a product or security incident.

Stanton regularly counsels technology, energy, financial services, retail, and other consumer-facing companies on US and international data privacy and cybersecurity regimes, including the FTC Act, GDPR, CCPA, GLBA, COPPA, HIPAA, state biometric privacy and data broker laws, and advertising and consumer protection laws such as CAN-SPAM, TCPA, and ROSCA.

Stanton brings a pragmatic perspective to this work shaped by significant in-house and secondment experience, having served as an attorney at Microsoft and on secondment to leading technology companies, including eBay and Meta, supporting global data protection program development, product counseling, incident and regulatory response, and commercial transactions.
 

Phoebe Rowson-Stevens, Associate Attorney, Gibson Dunn

Phoebe Rowson-Stevens is an English-qualified associate in the London office of Gibson, Dunn & Crutcher UK LLP and a member of the firm’s Technology,  Technology Transactions and Privacy, Cybersecurity and Data Innovation Practice Groups.

Phoebe advises clients across a wide range of sectors on data privacy compliance, technology transactions and artificial intelligence issues. Prior to joining Gibson Dunn, Phoebe worked at another major international law firm in London.