Privacy in M&A: Getting Acquisition-Ready
May 12, 2026
Gabe Maldoff is a Partner in Goodwin Procter, where he helps companies navigate privacy, cybersecurity, and AI governance in the context of data-driven products, corporate transactions, and regulatory investigations. He’s worked across the U.S. and the UK and advises clients on cross-border data transfers, international frameworks, and emerging technologies like AI, virtual and augmented reality. Gabe is also an Adjunct Professor at the University of Maine School of Law, where he teaches Global Privacy Law. This episode focuses on privacy considerations in M&A, especially from the perspective of startups preparing for acquisition and what acquirers really look for when evaluating privacy programs.
In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Gabe Maldoff, a partner in Goodwin’s Data, Privacy, and Cybersecurity practice, about privacy in mergers and acquisitions Together, they discuss why startups and fast-growth companies should address privacy early, how to navigate privacy due diligence without derailing deals, and how clear confident answers about data practices can help build trust during a transaction.
In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Gabe Maldoff, a partner in Goodwin’s Data, Privacy, and Cybersecurity practice, about privacy in mergers and acquisitions. The conversation explores why investment rounds and acquisitions often become forcing factors for privacy maturity, especially for startups and fast-growth companies preparing for their next stage of growth.
The discussion covers what sellers should prepare before due diligence, how privacy representations work in transaction documents, when disclosure is legally required versus strategically useful, and why the way a company explains its privacy posture can matter as much as any underlying issues.
What this episode covers:
- Why investment rounds and acquisitions can drive privacy maturity
- How uncertainty around data practices creates deal friction
- The difference between required legal disclosures and strategic disclosures
- Why buyers often evaluate security incidents based on the quality of the response
- Why AI representations and vendor diligence are becoming more important in deals
- How data governance, privacy notices, and recordkeeping can support acquisition readiness
- Three practical steps companies can take today to better position themselves as acquisition-ready
And so much more!
Connect with Gabe Maldoff here: LinkedIn
Connect with Kellie du Preez here: LinkedIn
Connect with Danie Strachan here: LinkedIn
If you enjoyed this episode, make sure to subscribe, rate, and review it.
Episode Highlights:
- [05:20] The Biggest Privacy Deal Breakers
The issue is not necessarily the existence of privacy gaps. More problematic is not knowing they exist. Buyers can price risk, but they can’t price uncertainty. Transparency and self-awareness beat perfection every time.
- [20:47] Security Incidents: What to Disclose and How
Many companies will face an incident eventually. What matters most is the quality of the response, including proper investigation, the right advisers, and taking ownership. A big breach handled well raises fewer red flags than a small one handled poorly.
- [34:21] The Most Valuable Privacy Investment You Can Make
Not every company needs a CPO, but every company needs someone who owns privacy. The right person drives milestones, communicates risk to executives, and brings the calm confidence that buyers look for. People are the single most lucrative investment in privacy.
- [46:04] Three Things You Can Do Today to Be Acquisition-Ready
Buyers are not looking for perfection. They are looking for signs of operational maturity, accountability, and trustworthiness. We explore several areas that can have an outsized impact on how companies are evaluated during diligence.