In the questionnaire, the target company answers that it has never had a data incident. Nobody checks. Months after closing, the incident surfaces, and the first question is whose system it was, and on what date.
Incidents, privileged accounts, third parties, personal data, licences, code and executives: what to verify before closing and how to preserve evidence in a spin-off.
An M&A transaction rests on representations about systems, data and people. Some of them can be verified before signing, in the target company's logs, devices and emails. When nobody verifies, the representation becomes the only evidence, and it was written by the seller.
The risk outlasts the closing. Under the Brazilian Anti-Corruption Act (Law 12,846/2013, art. 4º), the legal entity's liability survives merger by absorption, merger and spin-off. In a data incident, the question is whose system was hit, and on what date.
The course shows what to examine, how to request it, how to separate representation from evidence and how to preserve in a spin-off, so that the evidence is born intact and can serve again if the deal turns into a dispute.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
In an incident in an environment that was changing hands, tens of terabytes were preserved before remediation, precisely to separate the inherited systems from those of the new operation. It is this dated evidence that gives a technical basis to the discussion of who is liable.
In a merger, the board needed to know whether any executive had relationships that could compromise the deal. The examination covered the executives' computers and phones and searched their emails for keywords defined in advance, recording the origin and integrity of each message. The board received the findings with a chain of custody.
A company wanted to know whether customers' card data was circulating outside the authorised systems. The examination of the sales department's workstations found card numbers stored in plain text, and the company received a formal preliminary notice before the final report.
The groups receive the fictitious profile of a software target company, with what the seller declared in the questionnaire. In 15 minutes, they build the list of technical requests for the data room, mark whether each expected answer will be a representation, a document or verifiable evidence, and point out three warning signs that would justify a forensic examination before closing.
Laws and rulings discussed
Law 12,846/2013, art. 4º, caput and §§ 1º and 2º (Brazilian Anti-Corruption Act) · Decree 11,129/2022, art. 57, XIV · CD/ANPD Resolution 15/2024, art. 10 · LGPD, arts. 37 and 42 (Brazil's data protection act) · Law 9,609/1998, art. 4º (Brazilian Software Act)
See also
Forensic Services in Corporate and M&A → LGPD, ANPD and Data Breach Forensics → Information Security and Compliance → Software and Development Project Forensics → See all courses →