Before you combine acquired customer data

Your company has acquired a product. Someone asks to import its customer list into your CRM and announce the combined offering. The deal folder has privacy documents; the integration ticket says “migrate customers.” Neither tells the implementation team exactly which use has been reviewed.

Write the proposed action as a sentence: “Add the acquired scheduling app’s customer email addresses to the buyer’s product-announcement list.” Treat service messages, promotion of another product and combined usage histories as separate requests. A decision about one should not silently become a decision about the others.

Use the handoff below to connect that request to evidence and named owners. Bring privacy counsel in while the use is being defined, alongside the deal lawyer where transaction terms matter. This is a preparation tool, not permission to transfer or use data.

This example is fictional. The “current notice,” export and missing records are example inputs, not a conclusion about an actual business.

Proposed change · product owner

Add acquired customer emails to the buyer’s product-announcement list. Product should specify the audience, message, destination system and whether a smaller audience would meet the goal.

Evidence in hand · deal team

A saved copy of the seller’s current notice mentions service messages. The CRM export marks some rows “unsubscribed.” Attach each source with its version or capture date, where it came from and the person who can explain it.

Still missing · seller’s operations owner

The notice and signup wording shown when these people joined; the relevant agreements; the meaning and history of the export’s status values. A current notice alone does not show what every customer saw.

Decision requested · privacy counsel

Can this particular audience receive this particular message from the buyer? What facts, transaction terms, laws and customer choices affect the answer? Which records must be excluded or resolved first, and what conditions would need to be met?

Implementation question · engineering owner

How would each source status map to the destination? What happens to an unsubscribed, blank or unrecognized value? Identify who can test the mapping before anyone enables the proposed audience or campaign.

Current disposition · integration lead

Proposed use remains unresolved. The next meeting is to review missing evidence and the mapping plan, not to treat an import-ready file as an approved audience. Existing service operations need their own documented handling.

A line that says “privacy reviewed” is hard to implement. Ask the deal team to identify the specific question counsel answered and the evidence used. If the answer covered only transfer at closing, take the proposed marketing use back for its own review.

For each source, record the version, the period or customer group it covers, the owner and any gap. Preserve the difference between the seller’s explanation and the underlying notice, agreement, configuration or record. “The seller says the list is opted in” is a statement to check, not a substitute for the relevant evidence.

• Product: the exact use, audience, data fields, receiving teams and intended systems.
• Deal and privacy teams: relevant notices, collection wording, agreements, diligence questions and the scope of any prior advice. Share legal advice through the channels counsel approves.
• Operations and engineering: definitions for consent, preference and suppression fields; access arrangements; retention settings; and how customer requests reach the right team.

Have counsel identify the relevant jurisdictions and any special data categories. Do not substitute a generic checklist for that assessment. Use your team’s approved process for handling customer records and deal documents.

Before implementing an approved use, translate its conditions into a small test with engineering. Work with synthetic records until the team has agreed how real data may be handled.

Record the outcome in the integration ticket in the form counsel approves: the use reviewed, counsel’s conditions, implementation owner, test evidence and unresolved exceptions. Revisit it when the audience, purpose or destination changes. One successful field-mapping test does not establish that the proposed use is lawful.

Use this fictional request with Lawtrades Agent, our AI assistant, to practice organizing the handoff. Review the answer against the inputs before adapting the structure for your team.

Open the example in Agent ↗

Opens an editable message in a new tab. Nothing is sent automatically. Use only this fictional request for the exercise; do not add customer records or deal documents. You can also select and copy the text below.

Work through this fictional acquisition handoff. A buyer wants to add an acquired scheduling app’s customer emails to its own product-announcement list. The seller’s current notice mentions service messages. An older notice and signup wording have not been located. A CRM export labels some rows “unsubscribed”; engineering has not checked how that flag maps to the buyer’s system. Make a filled handoff: proposed use, available evidence, missing facts, questions for privacy counsel and checks for engineering. Keep facts separate from proposals. Do not infer permission, choose a legal basis or recommend sending messages. End with the first useful next step for each owner. Do not access systems or take external action.

A useful answer separates the proposed campaign from the records available, names the missing historical wording and asks how “unsubscribed” is handled. It should give the deal team, counsel and engineering different next actions. Challenge any answer that turns a missing record into permission or supplies an approval nobody gave.

For your actual project, give counsel the source packet and proposed use through your approved channel. Agent can help organize the exercise; it has not verified your systems, customer permissions or transaction documents.

A useful initial assignment is: review one proposed post-acquisition data use, identify the evidence still needed, and document the conditions or unresolved issues the integration team must address. Specify the audience, jurisdictions, data categories and decision date. Ask whether advice about transaction documents, customer communications or other jurisdictions needs additional counsel.

Agree on the deliverable: an evidence list with gaps, a decision for the defined use, and implementation conditions with owners. Scope notice drafting, contract changes, a wider data audit and integration builds as separate work where needed. Counsel’s answer may narrow or change the plan; the lawyer is part of designing it, not a final stamp on a completed migration.

Find legal talent for the project →

The examples and handoff are original editorial guidance. Two regulator sources explain why the underlying evidence matters:

• The UK ICO’s M&A data-sharing guidance covers original purposes, lawful basis, documentation and technical advice. It is UK-specific and marked under review following the Data (Use and Access) Act; counsel should check the current position.
• In its 2014 notice to Facebook and WhatsApp, FTC staff said WhatsApp must honor its existing privacy promises regardless of the acquisition. This historical example is not a universal consent rule for every acquisition.

Sources checked October 5, 2026. Use the resources below for broader data mapping or an earlier product-design question.