How GDPR compliance can contribute to a company's valuation
Key takeaways
Effective data governance and GDPR compliance help companies manage risks and preserve the economic value of their data. This value is not necessarily reflected in their financial statements. In mergers and acquisitions, data quality and the risks associated with its use can influence the target company's valuation, the purchase price, and contractual warranties.
GDPR compliance is generally viewed in terms of regulatory obligations and the risk of penalties. However, effective personal data management can also contribute to a company's economic value. This is highlighted in a joint study by the French (CNIL), Luxembourg (CNPD), and UK (ICO) data protection authorities, published on October 16, 2026. (1) The study focuses on three complementary areas: data governance and risk management, the accounting treatment and financial valuation of data, and the role of data in mergers and acquisitions and investment transactions.
1. Data governance and risk management as drivers of value creation
1.1 Effective governance for better use of data
Many companies rely on business-related and personal data for all or part of their commercial activities. Customer relationship management (CRM) tools help companies analyze customer needs and tailor their services accordingly. However, holding large volumes of data does not, in itself, create value. The value of data depends on its quality, reliability, availability, and the extent to which it can be lawfully used. Effective data governance requires clear rules governing data collection, use, sharing, retention, and deletion, as well as clearly defined responsibilities within the company.
The processing of personal data must comply with the principles set out in Article 5 of the GDPR, particularly lawfulness, purpose limitation, data minimization, accuracy, integrity, and confidentiality.
A structured governance framework not only improves the quality of data used in a company's commercial and operational activities, but also reduces the costs of retaining unnecessary or outdated data, facilitates the identification of risks associated with its use, and strengthens trust among customers, business partners, and investors.
This approach is particularly important for artificial intelligence projects, where system reliability depends in part on the quality of the data used and, where personal data is involved, on the legal conditions governing its processing.
1.2 Data-related risks can result in a loss of value
Poor data management can lead to administrative fines, litigation, remediation costs, and business losses, as well as reputational damage.
In the context of data due diligence, the joint study published by the three data protection authorities proposes an approach based on three complementary dimensions:
i. Business, by assessing the contribution of data to the company's revenue and growth prospects;
ii. Risks, by assessing their likelihood, severity, and time horizon; and
iii. Compliance, by considering governance rules, controls, and measures designed to manage these risks.
[Source: Joint CNIL, CNPD, and ICO study]
For example, a customer database may contribute directly to a company's revenue. However, its economic value may decline if the information is inaccurate, its use is legally questionable, or certain data must be deleted.
GDPR compliance therefore does not automatically increase a company's value. It can, however, help preserve the economic benefits derived from data use and reduce the risks affecting its future use.
1.3 Cybersecurity as a means of preserving value
Information systems security also contributes to preserving this value.
A cyberattack may compromise the confidentiality, integrity, or availability of data. The consequences can be wide-ranging, including service disruptions, database restoration costs, lost revenue, and reputational damage.
Article 32 of the GDPR requires controllers and processors to implement security measures appropriate to the risks involved, such as access controls, encryption, backups, security testing, and incident response procedures. Beyond compliance with regulatory requirements, these measures are intended to protect the information on which the company's operations depend and limit the economic consequences of an incident.
Data governance, legal protection of data, and cybersecurity must therefore be coordinated, with the involvement of legal, IT, finance, and senior management teams.
2. Accounting for and valuing data
2.1 Economic value is not necessarily reflected on the balance sheet
Data can represent a significant economic resource without its full value being recognized in a company's financial statements. The economic value of data, based on the financial benefits expected from its use, must be distinguished from its accounting treatment, which is subject to specific rules.
Under the International Financial Reporting Standards (IFRS), IAS 38 requires an intangible asset to be identifiable, controlled by the company, and capable of generating future economic benefits. (2) Recognition also requires that its cost can be measured reliably.
Databases acquired from third parties may, under certain conditions, be recognized as intangible assets.
Certain costs incurred in developing databases internally may also be capitalized if they meet the requirements of IAS 38. However, internally generated customer lists cannot be recognized as intangible assets (par. 63).
These distinctions explain why a company may use economically valuable data without its full value being reflected on its balance sheet. The applicable rules must also be assessed in light of the accounting framework used by the company.
2.2 How can the economic value of data be assessed?
The study identifies three main valuation approaches:
i. The cost approach, which estimates the expenditure required to collect, compile, or replace the data;
ii. The market approach, which relies on prices observed in transactions involving comparable assets, provided reliable reference data is available; and
iii. The income approach, which estimates the future financial benefits expected from the use of the data.
Where personal data is involved, these methods must account for the legal limitations governing its use. For example, a marketing prospect database compiled unlawfully may have a lower value than initially estimated if its use must be restricted or discontinued. Conversely, a database that is properly documented, kept up to date, and used in compliance with the GDPR provides greater certainty regarding its potential future use.
2.3 How does this affect company valuation?
A company's financial valuation takes into account its ability to generate future revenue, its growth prospects, and the risks associated with its activities.
The study refers to the discounted cash flow (DCF) method, which involves estimating future cash flows and discounting them to reflect their timing and the associated risks.
Compliance issues can affect this valuation through restrictions on data use, remediation costs, litigation, or lost revenue. These risks must be consistently reflected in the valuation assumptions to avoid double counting.
However, the survey conducted as part of the study reveals that these issues are not yet systematically taken into account. Of the 199 respondents, 76 indicated that databases were not reflected in their financial statements, while 58 did not know how they were accounted for. Furthermore, among 196 respondents, 52% reported that data-related risks were not factored into their company's financial valuation, while nearly one-third did not know whether such risks were considered.
These findings, based on a sample of French companies with a Data Protection Officer (DPO), illustrate the gap between the economic importance of data and the extent to which it is reflected in financial valuation practices.
3. Due diligence in mergers, acquisitions, and investment transactions
3.1 GDPR compliance as a factor in target company valuation
In an acquisition or equity investment, the buyer or investor seeks to identify risks that could affect the target company's value and operations. For companies whose business model relies on personal data, a GDPR compliance audit is an important component of this assessment. Non-compliance may expose the company to financial risks.
The audit must also determine the conditions under which the data can continue to be used after the transaction. Two situations should be distinguished. In a share acquisition, the target company retains its separate legal personality. However, changes contemplated following the acquisition may require a reassessment of its data processing activities. In an asset acquisition, the disclosure of personal data to another legal entity requires a specific assessment of the lawfulness of the operation.
In both cases, the transaction does not automatically entitle the buyer to reuse the personal data bases. The legal requirements governing the intended processing activities, their compatibility with the original purposes, and the obligations to inform the data subjects must be assessed. Consent may be required in certain circumstances.
3.2 Key areas to review in GDPR due diligence
The study recommends an approach that goes beyond merely reviewing compliance documentation. Data due diligence should assess the economic contribution of data, the associated risks, and the measures implemented to ensure its proper management.
The main areas of review include:
· Strategic data: The nature and quality of data, mapping of processing activities, and contribution to revenue;
· GDPR compliance: Lawfulness of processing, purposes, information provided to data subjects, retention periods, and management of data subject rights;
· Contractual arrangements: Data processing agreements, data sharing, and international data transfers;
· Security: Protective measures, previous incidents, and remediation procedures;
· Governance: Internal responsibilities, policies, procedures, and controls; and
· Financial risks: Complaints, litigation, regulatory investigations, and foreseeable compliance remediation costs.
For companies developing artificial intelligence systems, the audit must also examine the origin and quality of the data used, as well as the legal conditions governing its reuse.
The audit should involve legal, technical, and financial teams to ensure a comprehensive assessment of the risks.
3.3 Impact on the purchase price and transaction terms
The findings of the due diligence review can directly influence negotiations.
Where a significant risk is identified, the buyer may seek a price reduction, specific representations and warranties, indemnification provisions, or commitments to achieve GDPR compliance. Depending on their severity, certain risks may also lead the buyer to revise the scope of the acquisition or even withdraw from the transaction.
Conversely, a company with documented governance practices and appropriate security measures is better positioned to demonstrate effective risk management and support its valuation.
3.4 Preparing for due diligence and post-acquisition integration
A company whose business relies heavily on databases can prepare for negotiations by conducting vendor due diligence. This review helps identify strategic data, document processing activities, and address potential compliance shortcomings.
Following the acquisition, the integration of information systems, consolidation of customer databases, or deployment of new analytics tools may also change the conditions under which personal data is processed.
These projects must be assessed from both legal and technical perspectives to maintain compliance and preserve the economic benefits expected from the transaction.
The joint study published by the CNIL, CNPD, and ICO highlights the importance of incorporating data protection considerations into management and investment decisions, while also identifying the current limitations of accounting recognition and financial valuation methods. This economic dimension is particularly relevant in mergers and acquisitions, where compliance and governance can influence risk assessments, the purchase price, and transaction terms.
For companies operating in the digital sector, the objective is twofold: to demonstrate regulatory compliance and to assess the economic value, risks, and future opportunities associated with the use of their data.
* * * * * * * * * * *
(1) CNIL, CNPD and ICO, October 2026, From Data Protection to Value Creation in Finance: Data Valuation, Accounting, Mergers & Acquisitions and Governance – Practical Applications in Data Driven Organisations; and ICO, Value Creation Research.
(2) International Accounting Standard IAS 38, Intangible Assets, particularly paragraphs 21, 57, and 63.
Bénédicte DELEPORTE
Avocat
Deleporte Wentz Avocat
November 2026