1. Start with a scoped, risk-based plan
Begin by drafting a due diligence plan that maps the deal structure (asset purchase, share purchase, merger), key risk areas and the information flow. Allocate resources proportionate to risk: a small regional practice with minimal regulated client money requires a different depth of review from a multi-jurisdictional firm with large client funds and complex litigation portfolios. Early scoping should identify regulated activities, client money/accounts, ongoing litigation, high-value or high-sensitivity client files (e.g., family, corporate, insolvency), and people-risks (partner agreements, fee-earners, and equity structures). This prioritisation lets counsel and advisers focus their time where failure would be most damaging.

2. Data protection & Personally Identifiable Information: don’t treat it as an afterthought
M&A is inherently a data-intensive process: bidder teams read client files, access HR records, and often consolidate systems. Under UK data protection law, transfers of personal data or changes in controller/processor relationships require careful assessment of lawful bases, contractual arrangements and security measures. Practical steps:

• Obtain a data map and inventory: types of PII (Personally Identifiable Information) held, where it resides (on-premise, cloud, backups), and who has access.
• Request documented policies and DPIAs (Data Protection Impact Assessments) relevant to high-risk processing.
  Review prior data incidents, breach reports and ICO correspondence. An unresolved or poorly handled breach can lead to fines and remediation exposure.
• Check client consents and engagement letters for data-sharing clauses and whether any client-specific restrictions exist.
• Assess technical security (encryption, access controls, logging), and include cyber-security evidence in diligence.

The ICO explicitly expects organisations to consider data sharing as part of M&A due diligence and to establish lawful bases when data controllers change or merge. Failure to do so has led to regulatory scrutiny and significant financial consequences in past M&A-adjacent enforcement actions.

3. SRA regulatory fitness: clients come first
The SRA’s position on law firm M&A is clear: client interests must remain paramount and firms must comply with regulatory obligations during sales, acquisitions and mergers. Practically, that means:

• Verify regulatory status and any outstanding SRA investigations, enforcement action, or client complaints. SRA warnings or enforcement history are red flags.
• Review client matter registers and identify vulnerable clients, client money accounts, escrow arrangements and mandate limitations.
• Confirm adequacy of anti-money laundering (AML) controls and client identity checks. Weaknesses here can imperil the buyer’s permissions and trigger post-deal liabilities.
• Assess whether the proposed deal structure preserves the buyer’s ability to meet SRA accounts rules and client confidentiality requirements throughout transition.

The SRA’s recent guidance and warning notices emphasise that insufficient due diligence in mergers can lead to harm to clients and regulatory action so evidence of careful regulatory review is essential in boardroom sign-off and for lender comfort.

4. TUPE and people risks: capture the employee liabilities
Where services, client-related teams or whole business units are transferred, TUPE (Transfer of Undertakings (Protection of Employment) can automatically transfer employees and their terms to the buyer. For law firms, the consequences are acute: partner-level arrangements, fee-earner continuity, pension liabilities and confidentiality obligations must be checked.
Key TUPE diligence steps:

• Obtain full Employee Liability Information (ELI): contracts, length of service, pay, benefits, disciplinary and grievance history, collective agreements, and pension arrangements.
• Identify employees who work “wholly or mainly” in the service being transferred and any associated subcontracting/service provision changes that might trigger TUPE.
• Review change-of-service risks (restructuring, redundancies) and model the cost of consultation obligations and potential claims.
• Check partner/fee-earner agreements for change-of-control provisions and restrictions (e.g., post-termination restrictions, client ownership clauses).
• Run people interviews and HR system audits to spot unrecorded liabilities (e.g., unpaid leave, secondments, off-payroll arrangements).

Recent regulatory and legal updates have altered practical requirements around information and consultation and emphasised the importance of accurate ELI so buyers should budget time to validate HR records and to consult with employee representatives where TUPE applies.

5. Practical mechanics: Data Rooms, Staged Access and Data Hygiene
A well-managed electronic data room (VDR) reduces leak risk and supports phased diligence. Best practice:

• Use staged access: give red-flagged items (e.g., high-value client files, HR records) restricted view until NDAs and data-processing agreements are executed.
• Require minimal data extraction review in-platform where possible and limit full downloads.
• Insist on an agreed enquiry list and a single point of contact on each side to avoid repeated, uncontrolled document pulls.
• Maintain a rolling issues log to capture outstanding compliance items and required post-completion actions.
• Maintaining an audit trail of who saw what and when is both a security and regulatory necessity in legal sector deals.

6. Negotiation Levers: Indemnities and escrow
Where diligence identifies residual risks, deploy contractual protections: detailed warranties, bespoke indemnities for regulatory fines or client-related liabilities, escrow arrangements or price adjustments. For SRA-sensitive liabilities or potential TUPE claims, the market may require a longer retention or specific indemnity caps. Insurers increasingly underwrite regulatory and cyber risks, but premium and coverage details must be examined during diligence so buyers understand the residual risk appetite.

Conclusion and post-close compliance
Due diligence should not end at completion. Agree a post-completion integration plan that addresses client notifications, file transfers, system migrations, staff retention measures and a timetable for harmonising compliance policies. Set clear governance: who owns client conflicts checks post-close, who is responsible for post-transaction remediation, and how regulatory reporting will be handled.

Thorough pre-merger due diligence in the UK legal market blends legal, regulatory, HR and cyber-security expertise. Given the severe consequences of getting it wrong (regulatory enforcement by the SRA or ICO, TUPE claims, client loss and reputational damage), most transactions benefit from professional merger facilitation. Specialist advisers not only spot issues earlier but design mitigation, drafting and integration plans that preserve value and protect clients. If your firm is planning a transaction, consider engaging Ampersand Legal to ensure the deal delivers the growth you expect, without regulatory surprises.