Germany: Adopted DSK Resolution on personal data protection in asset deals

On 11 September 2024, the Conference of the Independent Data Protection Authorities of Germany (DSK) adopted a resolution on personal data protection in asset deals. The resolution applies to businesses involved in company acquisitions through asset deals, particularly for sectors where personal data, such as customer, employee, or supplier data, is integral to the transaction. The resolution clarifies data protection obligations, differentiating between customer data in contract initiation, ongoing, or terminated relationships. To ensure compliance with the General Data Protection Regulation, the resolution emphasises that customer consent is required for certain data transfers, particularly when sensitive data like health information or employee data is involved. The resolution also stresses that the seller is responsible for data protection during the transfer, including implementing adequate security measures.