Data Sharing in Merger or Acquisition

What it is

If Udemy is sold, merges with another company, or goes through bankruptcy, your personal data could be transferred to the new owner, who would then govern it under their own privacy policy.

Why it matters (compliance & governance perspective)

A change in corporate ownership could result in your data being governed by a materially different privacy policy, potentially with broader data-use rights than you originally agreed to.

Consumer impact (what this means for users)

This provision means that in a corporate transaction, your personal data including account, payment, and learning history could pass to a new entity, and the protections you rely on today may change after such a transfer.

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: Under GDPR, transfer of personal data in a corporate transaction requires a lawful basis for the new processing entity; the policy's notice commitment is a positive step but does not itself establish a GDPR-compliant transfer mechanism. The FTC has previously taken enforcement action regarding acquisitions where post-merger data use exceeded what users originally consented to (FTC v. Facebook/WhatsApp being a frequently cited context, though not directly binding on Udemy). CCPA requires that the acquiring entity honor opt-out and deletion requests made prior to the transaction. 2. GOVERNANCE EXPOSURE: Medium. This is a standard clause in most platform privacy policies, but its practical impact depends on the acquirer's data governance practices. The policy's commitment to provide notice before transfer is a meaningful transparency obligation, though it does not grant users a right to prevent the transfer or delete their data prior to it. 3. JURISDICTION FLAGS: EU/EEA users have the strongest protections, as GDPR requires that any new controller establish an independent lawful basis and, where processing materially changes, provide updated Article 13/14 notices. California residents retain CCPA rights against the acquiring entity. Users in jurisdictions without comprehensive privacy law have the least recourse if the acquirer changes data practices post-transaction. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise clients and B2B partners should review whether their DPAs with Udemy include provisions governing assignment of the agreement in a change-of-control scenario, and whether successor entities are required to honor existing DPA terms. Due diligence in a potential acquisition of Udemy would include assessment of outstanding data subject requests, regulatory investigations, and the scope of personal data held. 5. COMPLIANCE CONSIDERATIONS: Organizations relying on Udemy for enterprise learning should monitor for any announced corporate transactions involving Udemy and review updated privacy terms promptly. Compliance teams should confirm whether existing DPAs and data transfer mechanisms remain valid following any such transaction.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Udemy Business Employer Data Sharing high
• Third-Party Advertising and Analytics Data Sharing medium
• California CCPA/CPRA Rights low
• Cross-Border Data Transfers (EU-U.S. Data Privacy Framework) medium
• Children's Privacy and Age Restriction medium
• Data Retention medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.