In today's digital economy, customer data is often one of the most valuable assets a company owns. Buyers routinely justify acquisition premiums based on the size, quality, and commercial potential of a target company's customer database. Marketing strategies, customer analytics, cross-selling opportunities, artificial intelligence initiatives, and future revenue projections frequently depend upon the assumption that acquired data can be lawfully exploited after completion.
However, a growing number of acquirers are discovering an uncomfortable reality: not all data assets are legally usable.
Under Thailand's Personal Data Protection Act (PDPA), personal data may only be collected, used, disclosed, and retained where the organisation has established a valid legal basis and complied with statutory requirements regarding transparency, consent, security, and data subject rights. Where these requirements have not been satisfied, a customer database may possess little or no practical commercial value despite appearing to be a significant asset during negotiations.
From an M&A perspective, improperly collected personal data can become what transaction professionals increasingly describe as a “toxic asset” an asset that appears valuable on paper but creates legal, regulatory, financial, and operational liabilities once acquired.
The problem frequently arises when a target company has accumulated customer information over many years without implementing compliant PDPA procedures. Legacy databases may contain personal information collected through outdated website forms, historical marketing campaigns, purchased lead lists, loyalty programmes, mobile applications, or business development activities that predate modern data protection standards. During due diligence, management may present a database containing hundreds of thousands of customer records and attribute substantial value to the asset. However, if the legal basis for processing cannot be demonstrated, the buyer may discover after closing that the data cannot be lawfully used for the very purposes that justified the acquisition premium.
The consequences extend far beyond regulatory compliance. In many transactions, customer databases are recognised as identifiable intangible assets during purchase price allocation exercises. The acquisition accounting process may assign significant value to customer relationships, marketing databases, user profiles, behavioural data, and related digital assets. Those valuations are generally based upon the assumption that the acquired data can generate future economic benefits.
If post-closing investigations reveal that the target company lacks valid consent records, cannot demonstrate an appropriate legal basis for processing, or has failed to comply with PDPA requirements, the buyer may face severe restrictions on how the data can be used. Marketing campaigns may need to be suspended. Customer profiling initiatives may become legally questionable. Data sharing between group companies may require additional compliance measures. In extreme cases, portions of the database may need to be deleted entirely.
Once the anticipated economic benefits disappear, the accounting implications can be significant. Under applicable financial reporting standards, management must assess whether acquired intangible assets continue to support their recorded carrying values. Where future economic benefits are impaired due to legal restrictions on data usage, the buyer may be required to recognise a substantial impairment loss against customer-related intangible assets. The result can be an immediate reduction in earnings, deterioration of key financial ratios, and a significant write-down of assets that were acquired only months earlier.
This is why modern data protection due diligence has evolved far beyond reviewing a company's privacy policy. Sophisticated buyers now conduct detailed assessments of data governance frameworks, consent collection mechanisms, retention policies, cybersecurity controls, third-party data sharing arrangements, international data transfers, data breach history, and the legal basis supporting each category of personal data processed by the target business. The objective is not merely to identify regulatory risks but to verify whether the data asset being acquired can actually deliver the economic value reflected in the purchase price.
The issue becomes particularly important in sectors where enterprise value is heavily dependent upon customer information. E-commerce businesses, digital platforms, software providers, financial technology companies, healthcare operators, education providers, marketing agencies, and subscription-based businesses often derive a substantial portion of their valuation from customer data assets. In these industries, PDPA compliance is no longer simply a legal matter it is a fundamental component of asset valuation.
Given the potentially severe consequences, buyers increasingly seek extensive PDPA-related protections within the Share Purchase Agreement (SPA). Sellers may be required to provide detailed representations and warranties confirming that personal data has been collected, processed, stored, and disclosed in compliance with applicable data protection laws. Buyers frequently request specific warranties regarding consent records, privacy notices, cybersecurity measures, data breach incidents, third-party processing arrangements, and the absence of regulatory investigations. Where data assets represent a material component of transaction value, general warranties are often supplemented by specific indemnities designed to protect the buyer against future losses arising from pre-closing non-compliance.
The importance of these protections cannot be overstated. Unlike many operational risks, data protection deficiencies often remain invisible until integration activities begin after completion. By the time issues are discovered, the purchase price has already been paid and the buyer may have limited practical remedies unless adequate contractual protections were negotiated during the transaction process.
For investors, private equity funds, and strategic acquirers, the lesson is increasingly clear: the value of a customer database is not determined by the number of records it contains but by the legal ability to use those records. A database containing one million customer profiles may be worth less than a database containing one hundred thousand fully compliant and legally usable records.
In modern M&A transactions, data should be evaluated with the same rigour applied to financial statements, tax exposures, and regulatory licences. A customer database that cannot be lawfully monetised is not merely a compliance issue it is a valuation issue, an accounting issue, and ultimately a deal value issue. Buyers who fail to recognise this distinction risk paying a premium for an asset that may never generate the economic returns upon which the acquisition was originally justified.
As data increasingly becomes the cornerstone of corporate value, PDPA compliance is no longer simply a legal obligation. It is a critical determinant of whether a company's most valuable asset is truly an asset at all.
