Data and analytics consulting firm due diligence

Due diligence on a data consultancy is a comparison exercise. The firm has told the buyer what it does with client data, who wrote its tools and who delivers its work, and diligence checks each statement against a document, a system or a person. The useful comparisons set two things side by side: a client contract against the firm’s actual practice, an accelerator against its author’s paperwork, an organization chart against whoever really answers the client’s call. This guide sets out which comparisons to make, what a finding means when it appears, and which findings may put a deal in doubt. The general mechanics of diligence are covered elsewhere on the site; this page keeps to what is particular to a data and analytics firm.

Put each client contract beside the data practice behind it

Start with the data-processing terms in every client agreement, or their absence. For each client, record what the contract says about where data may be held, who may access it, whether subcontractors are allowed, how a breach must be reported to the client, and what must be returned or destroyed at the end. Then test the firm’s real practice against that record. PIPEDA says an organization that transfers personal information to a third party for processing remains responsible for it and must use contractual or other means to provide a comparable level of protection, so a gap in the firm’s terms may also be a gap in the client’s own compliance. A missing data-processing agreement for a client whose personal data the firm handles is a serious finding: the firm cannot show the protection its client was required to secure, and the client may ask for terms the buyer never priced.

Trace where client data actually sits

Ask for a data inventory, then test it against what the engineers say in interviews. Look beyond production environments to development sandboxes, analysts’ laptops, shared drives and extracts kept after a project ended. A contract that requires return or destruction at the end of an engagement can make a leftover copy a breach of its terms. For Quebec residents, the Commission d’accès à l’information says an organization must carry out a privacy impact assessment before communicating personal information outside Quebec and that such a communication needs a written agreement with set terms. Ask whether either exists for any hosting, support or subcontracting outside the province.

Read the incident history, and the lack of one

Ask for the firm’s breach record and any reports it made. The Office of the Privacy Commissioner of Canada’s guidance says PIPEDA requires an organization to report to the Privacy Commissioner any breach of security safeguards involving personal information under its control that poses a real risk of significant harm, to notify the individuals affected, and to keep records of every breach for two years whether or not that threshold was met. It adds that where information has been transferred to a third-party processor and a breach occurs there, the OPC finds it reasonable to treat the transferring organization as having control and responsibility for reporting, while noting that control is assessed case by case. For a consultancy, the notification clause in each client contract becomes the document to read first: a firm that tells a client late may leave that client unable to meet its own duty. In Quebec, the Commission d’accès à l’information says organizations must notify the Commission and the people concerned of any confidentiality incident involving personal information they hold that presents a risk of serious injury, and must keep a register of confidentiality incidents and give it to the Commission on request. A firm handling many clients’ data that has never recorded an incident deserves a follow-up question about how it would know.

Trace who wrote the code and models, and under what paper

Choose a sample of the accelerators and client deliverables the seller emphasises and trace each back to its authors. Under the Copyright Act the author is generally the first owner of a work, and an employer is the first owner of a work made by an employee in the course of employment, in the absence of any agreement to the contrary. An assignment is valid only if it is in writing and signed by the owner of the right or the owner’s duly authorized agent, so for contractors the question is whether a signed IP assignment exists. For client-funded builds, read the exact wording of the client contract: it may assign deliverables to the client or reserve the firm’s pre-existing tools. The Act also says moral rights cannot be assigned but may be waived, and that assigning copyright does not by itself waive them, so a waiver is a separate document to look for. Ask, too, which third-party and open-source components sit inside the tools, and on what licence terms.

Test the claims about people

Build a simple map of clients against the people who understand their pipelines, then check it by asking a second engineer to explain a pipeline the first one built. Where only one person can, key-person risk has become concrete. Compare each long-term contractor with the Canada Revenue Agency’s description of an employee, someone who generally works under the direction and control of the business under a contract of service, as against a self-employed worker who is not under the payer’s direction or control. A contractor who appears to work under the firm’s direction and control, in the sense of that description, is a finding to raise with an employment adviser. Finally, check what retention and non-solicit terms exist for the people the buyer needs, and whether they know about the sale.

Check the research-credit history

If the seller says the firm developed proprietary models or accelerators, ask whether it claimed SR&ED incentives for the work. The CRA’s SR&ED page describes a claim submitted with an income tax return and includes guidance on what to do when a claim needs a review. Request the claims filed, the project descriptions and technical records behind them, and any correspondence about reviews. How past claims, or credits for future work, are treated after a sale is a question for a tax adviser rather than an assumption to build into the price.

Findings that may put a deal in doubt

• Client data held in ways the contract forbids, with no sign that the firm knew
• No data-processing terms with clients whose personal data the firm handles
• Core accelerators written by contractors with no signed assignment
• A single person as the only available explanation of a major client’s pipeline
• Incidents that were never recorded or never reported to the client affected