Due Diligence

Also known as: Legal Due Diligence, DD, Company Review, Legal Review, Hukuki Durum Tespiti

In short

Reviewing a target company's corporate structure, contracts, employees, intellectual property, disputes and regulatory compliance before an investment or acquisition to identify risks.

Due diligence is the review of a target company’s legal position before an investment or acquisition. Its aim is for the investor or buyer to understand what it is buying and to see in advance the risks that will affect the transaction.

Main Areas Reviewed

Corporate structure: Articles of association, share register, general assembly and board resolutions, capital increases and the cap table,
Contracts: Customer, supplier and financing agreements; in particular change of control, exclusivity and non-compete clauses,
Employees: Employment contracts, employee stock option plans, potential employee claims and people engaged as contractors,
Intellectual property: Trademark and patent registrations, whether software and other works have been assigned to the company, open-source licences,
Personal data: KVKK compliance, VERBİS registration, cross-border transfers and data breaches,
Disputes: Pending and potential lawsuits, administrative investigations and fines,
Regulatory approvals and competition law: Licences required for the business, competition law risks.

Process

Signing a confidentiality agreement,
Sending a request list for information and documents,
Sharing documents in a virtual data room and answering questions,
Management meetings,
Preparing the report: usually a “red flag” report showing only material risks, or a full report.

Consequences of the Findings

Identified risks affect the transaction in different ways:

Reducing the price or pre-money valuation,
Making the fixing of the issue before closing a condition precedent,
Providing a specific indemnity for a particular risk,
Requiring comprehensive representations and warranties,
In serious cases, walking away from the transaction.

Sharing Personal Data

Personal data of employees and customers may be shared during due diligence. Sharing should comply with the data minimisation principle, use anonymised or aggregated data wherever possible and have its legal basis (usually legitimate interest) documented.

Frequently Asked Questions

How long does due diligence take?

It depends on the company's size and how ready its documents are. It may take a few weeks for an early-stage venture and a few months for the acquisition of an established company. Gathering documents in an organised data room in advance shortens the process considerably.

Can employees' personal data be shared with the investor during due diligence?

Only proportionately. Anonymised or aggregated data should be shared wherever possible, identity details should be redacted unless needed and access kept limited. Sharing must rely on one of the processing conditions under data protection law and be secured by a confidentiality agreement.

← Glossary A–Z