Deal activity across Kenya and the wider EAC is heating up — fintechs acquiring SACCO tech, telcos absorbing ISPs, regional banks snapping up smaller lenders. Yet most Kenyan M&A due diligence still treats cybersecurity as a checkbox buried under financial and legal workstreams. That oversight is expensive. When you acquire a company, you acquire its breaches, its unreported ODPC complaints, its unpatched servers, and its vendor contracts. The valuation you signed off on rarely survives contact with that reality.
Cybersecurity due diligence in M&A is the structured process of assessing a target company's security posture, data protection liabilities, and compliance gaps before deal close — so acquirers can adjust the price, demand remediation, or walk away. For Kenyan acquirers, this is now a board-level issue, not an IT one.
Why Cyber Risk Is the Deal-Killer Kenyan Acquirers Keep Missing
The Office of the Data Protection Commissioner (ODPC) has been issuing enforcement notices and fines under the Kenya Data Protection Act, 2019 — including penalties against well-known local brands for mishandling personal data. If you acquire a company carrying unresolved ODPC complaints, those liabilities transfer to you. The same applies to breach notification obligations: if the target suffered an incident it never disclosed, you inherit the exposure.
Three categories of hidden risk show up repeatedly in regional deals:
- Undisclosed breaches — ransomware, credential theft, or data leaks the seller either didn't detect or chose not to report.
- Data protection non-compliance — missing data processing agreements, no appointed Data Protection Officer, no DPIAs on record, cross-border transfers without lawful basis.
- Technical debt that becomes your problem — end-of-life systems, flat networks, unmanaged privileged accounts, and shadow SaaS.
If the target cannot produce a current data inventory, a DPIA register, and an incident log within 48 hours of your request, assume the worst and price accordingly.
The Four-Phase Cybersecurity Due Diligence Framework
A defensible process gives you leverage at the negotiating table. Here's the structure acquirers in Kenya should run.
Phase 1: Pre-LOI Reconnaissance
Before the Letter of Intent, use open-source intelligence. Check the target's domains for leaked credentials on breach databases, review their public attack surface (exposed RDP, outdated web servers, expired certificates), and search for any ODPC enforcement history or press coverage of incidents. This costs little and often reshapes the opening offer.
Phase 2: Documentary Review
Once under NDA, request:
- ISO 27001 certification status or equivalent framework alignment
- Last two years of penetration test and vulnerability scan reports
- Incident register and breach notification records
- Data Protection Act compliance artifacts: DPO appointment, ODPC registration, DPIAs, data processing agreements with vendors
- Cyber insurance policies and any claims history
- Third-party and cloud vendor contracts (especially AWS, Azure, M365)
Gaps in this documentation are themselves findings. A target with no DPIA on a customer-facing product that processes sensitive personal data is a red flag that will cost real money to remediate post-close.
Phase 3: Technical Validation
Documents lie; telemetry doesn't. With seller permission, run an independent assessment covering external attack surface, cloud configuration review, Active Directory hygiene, and endpoint posture sampling. For regulated targets — banks under CBK guidelines, telcos under CA regulations — validate alignment with sector-specific requirements. Cloud Security Assessment Service
Phase 4: Quantification and Deal Structuring
Translate findings into numbers the deal team can use:
- Remediation cost estimates (tooling, staffing, consulting)
- Potential regulatory fines under the Data Protection Act (up to KES 5 million or 1% of annual turnover, whichever is lower)
- Breach notification and legal costs if latent incidents surface post-close
These numbers justify price adjustments, specific indemnities, escrow holdbacks, or representations and warranties insurance.
Red Flags That Should Pause the Deal
Some findings warrant more than a price cut. Walk away — or restructure heavily — if you encounter:
- Evidence of an active, unremediated compromise
- Systematic non-compliance with the Data Protection Act and no DPO
- Customer data stored in jurisdictions with no lawful transfer basis
- Critical systems running on unsupported software with no migration plan
- A security team of zero, with no outsourced coverage
Post-Close: The First 100 Days
Due diligence doesn't end at signing. Build a 100-day integration plan that isolates the acquired network until baseline hygiene is confirmed, rotates all privileged credentials, consolidates identity providers, and brings the acquired entity under your incident response plan. Virtual CISO Services
Acquirers who skip this phase routinely discover — six months in — that the target was the pivot point for an attack on the parent.
Treat every acquisition as a potential insider threat until you've validated otherwise. Trust is earned through evidence, not assumed through signatures.
SecureZaidi helps East African enterprises achieve and maintain compliance. Get in touch.