A large part of the M&A process is granting a potential buyer, who in essence is a third party, access to more or less confidential data of the target company all of which is predominantly in the interest of the seller. This issue is exacerbated by the increasing trend to have every sales process organised as an auction with multiple parties invited into the data room. Even M&A lawyers have taken notice that the rules for data transfers have radically changed in recent years. But did the M&A community embrace them? How do those changes translate into the deal world today? Are we compliant? Are we taking risks we do not even know? Do we need to rethink certain aspects of our processes? The panel will first give an overview over the regulatory framework, then it will analyse where data protection comes into play in a (cross-border) transaction and eventually it will discuss where our best practices most probably need an overhaul.