Data Sharing in Corporate Transactions

What it is

If Fastly is acquired, merges with another company, or undergoes a significant financial transaction, your personal data may be transferred to the new or acquiring entity as part of that deal, potentially even before it is finalized.

Why it matters (compliance & governance perspective)

Personal data can transfer to a third party whose privacy practices may differ from Fastly's without you receiving prior individual notice or having a right to object, which is a common but material provision in corporate data flows.

Consumer impact (what this means for users)

In the event of a merger, acquisition, or asset sale involving Fastly, your personal data could be transferred to another company. The new entity may operate under different privacy terms, and you may have limited practical ability to prevent this transfer.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 6 lawful basis requirements for processing in the context of business transactions, as well as CCPA requirements that personal information transferred in a merger be used consistent with the original privacy notice or that consumers receive notice and opportunity to opt out. The FTC has historically scrutinized whether post-merger entities honor pre-merger privacy commitments, particularly where those commitments were material to consumer consent. (2) GOVERNANCE EXPOSURE: Medium-Low. This is a standard clause across the industry. The primary risk arises if an acquiring entity uses the acquired personal data in ways materially inconsistent with this policy without providing adequate notice and choice, which could attract FTC or EU DPA scrutiny. (3) JURISDICTION FLAGS: EU/EEA data subjects retain their GDPR rights regardless of corporate ownership changes. The lawful basis for continued processing must survive the transaction. California residents' rights under CPRA continue to apply to the transferee. Transactions involving data of EU residents may require DPA notifications depending on jurisdiction and transaction structure. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers whose data is processed by Fastly should include provisions in their service agreements requiring notification in advance of any corporate transaction that would result in transfer of their data to a third party, and should assess whether their own DPA with Fastly survives such a transaction or requires renegotiation with the acquirer. (5) COMPLIANCE CONSIDERATIONS: Legal teams should monitor for any Fastly corporate transaction announcements and assess whether applicable regulatory notification obligations are triggered, including data protection authority notifications in the EU. Data subject notification obligations following a change of controller should be evaluated against GDPR Article 14.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Controller vs. Processor Distinction medium
• Data Sharing with Advertising and Analytics Partners medium
• Cross-Border Data Transfers via Standard Contractual Clauses medium
• California Resident Rights under CCPA/CPRA medium
• Data Retention Practices medium
• EU/EEA and UK Data Subject Rights low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.