Signing day is not the finish line; it is where the riskiest information handling begins. Harvard Business Review has reported that between 70 and 90 percent of acquisitions fail to deliver their expected value, and integration problems are a frequent cause. Information makes that integration harder: two companies suddenly share systems, staff, customers and secrets, often before anyone has reconciled their security standards. Marriott learned this when a breach of guest records that began in the Starwood systems in 2014 was discovered in 2018, after the acquisition; the UK Information Commissioner’s Office later fined the company GBP 18.4 million. If you are a CEO, integration lead, general counsel or IT director, this article is for you. It explains how to plan, segregate, migrate and govern information safely, and why the data room providers for M&A you chose for diligence matter again after closing.
Why the Integration Phase Is Uniquely Risky
During due diligence, information flows one way: from seller to buyer, through controlled channels. After closing, flows multiply. Employees from both sides need access, systems connect, and decisions must be made quickly. Pressure for speed often outruns security.
The Risks to Anticipate
-
Inherited vulnerabilities. You acquire the target’s unpatched systems, weak credentials and unknown data stores.
-
Over-broad access. Teams are given wide permissions “to get things moving” and never scaled back.
-
Shadow data. Files held in personal drives or informal tools surface only after integration begins.
-
Departing staff. Uncertainty prompts resignations, and leavers may take sensitive files.
-
Regulatory gaps. The target may have handled personal information differently from your standards under the Privacy Act 1988.
-
Loss of audit history. Diligence records and decisions are scattered or deleted.
Learning From the Diligence Record
The diligence process itself tells you where to look. Review the questions buyers asked, the documents they opened most and the issues flagged but left unresolved. A well-run diligence repository records all of this, giving integration teams a map of the target’s sensitive areas.
Phase One: Plan Before Day One
The strongest integration programmes begin security planning before closing.
-
Appoint a joint integration lead with authority over information governance, supported by IT, legal, HR and compliance representatives.
-
Complete a security assessment of the target covering systems, access, data stores and incident history.
-
Define a classification scheme that both organisations will use from day one.
-
Set interim rules for information sharing before systems are merged, such as who may see customer lists or pricing.
-
Agree a communications plan so staff and customers hear consistent messages.
Clean Team Rules Before Closing
Until completion, competition law may restrict what the two businesses can share, particularly customer-level pricing and strategy. Use clean teams of external advisers or limited internal staff to prepare integration work without exchanging competitively sensitive data. Continue the rule set under legal advice until closing formally occurs.
Phase Two: Control Access and Choose Data Room Providers for M&A With Integration in Mind
Temporary measures often become permanent, so design them carefully.
-
Grant access by role and task, not by seniority or convenience.
-
Use time-limited permissions that expire automatically unless renewed.
-
Require MFA for all integration team members and any shared accounts.
-
Separate environments for the target’s legacy systems until they pass a security review.
-
Log all activity on shared repositories so you can show who accessed what.
Keeping a Secure Repository Alive
Many acquirers close the transaction room and lose the structured record. Instead, convert it into a controlled integration workspace. Choosing from data room providers for M&A with long-term archiving, role-based permissions and audit trails means the same index can support integration planning, regulatory filings and post-closing disputes such as earn-out or warranty claims. Ask providers whether they offer extended retention, how they handle archived rooms and what it costs to keep a room active after the deal.
Phase Three: Migrate Data Safely
Merging systems is where data is most likely to be mishandled.
-
Inventory first. List all repositories, databases and applications in the target, with owners and sensitivity.
-
Clean before moving. Delete duplicates and obsolete files, subject to legal retention requirements. The Corporations Act, for example, requires financial records to be kept for seven years.
-
Map permissions. Do not copy old access rights blindly; rebuild them against your role model.
-
Encrypt during transfer and verify integrity after migration.
-
Test in stages, starting with low-risk data.
-
Decommission securely. Once migration is verified, retire legacy systems and wipe or destroy storage properly.
Handling Personal Information
Customer and employee data raise specific duties. Check the purposes for which the target collected personal information, whether using it in the combined business is consistent with those purposes and what notices are needed. Review the target’s own breach history, because an unreported incident becomes your problem on closing.
Phase Four: Align People and Policies
Technology integration fails without cultural alignment.
-
Merge policies deliberately. Choose the stronger standard for each topic rather than defaulting to the acquirer’s.
-
Train both workforces on the combined rules, including how to classify and share documents.
-
Retain key knowledge holders. The IT administrator who understands the target’s systems may be the most valuable person on the integration team.
-
Offer a safe reporting channel for staff who find legacy data or security concerns.
-
Manage departures with prompt access removal and reminders about confidentiality obligations.
Communicating With Customers, Staff and Regulators
How you speak about information handling affects trust. Tell employees early which systems and policies will change, what stays the same and whom to ask. For customers, explain any change in who holds their data and why, and confirm that existing privacy commitments continue. If the target is regulated, check whether the acquisition triggers notification or approval requirements, and prepare answers about security controls in advance. Silence breeds rumours, and rumours often lead to the departures and careless behaviour that create security incidents.
Governance: Measuring Whether It Works
Track simple indicators through the first twelve months:
-
Percentage of target systems brought under common security controls
-
Number of accounts with excessive or unreviewed access
-
Outstanding diligence findings and remediation status
-
Incidents and near-misses, with root causes
-
Training completion rates in both workforces
Report these to the board regularly. Visible metrics keep security on the integration agenda when commercial priorities compete for attention.
A Sample First-100-Days Timeline
-
Days 1–10: Freeze unnecessary access changes, confirm the integration lead, and verify backups of both organisations’ critical systems.
-
Days 11–30: Complete the data inventory, review privileged accounts and bring MFA to every integration team member.
-
Days 31–60: Align policies, begin staged migration of low-risk data and run joint security training.
-
Days 61–100: Migrate sensitive systems, decommission legacy platforms and report results to the board.
Managing Records and Retention After Closing
Acquisitions create a records question that is easy to overlook: what must you keep, and for how long? Merge retention schedules so that financial, employment, tax and contractual records follow one standard, and suspend deletion for anything linked to a pending warranty claim, earn-out or dispute. Store the final signed agreements, disclosure schedules and diligence index in a secure, access-controlled location with a named owner. When a question arises two years later about what was disclosed, a clean record saves time and expense.
Common Mistakes to Avoid
-
Deferring security until after synergies are captured. Attackers target businesses in transition.
-
Shutting the transaction room too early, losing the audit trail.
-
Giving everyone access to everything to speed up integration.
-
Ignoring the target’s suppliers, who may hold sensitive data under contracts you now inherit.
-
Treating integration as an IT task rather than a leadership responsibility.
Conclusion
Integration is where the value of a deal is realised or lost, and secure information handling is part of that outcome. Plan before closing, control access tightly, migrate in stages, align policies and people, and measure progress. Continuity matters too: the repository and audit trail built during diligence can support the whole transition if you choose from data room providers for M&A that offer long-term retention, strong permissions and clear logs. With careful governance, you protect both the information and the deal thesis it supports.