Ayushi Dwivedi
29 Oct 2026 4 min read
Due diligence is sold to acquirers as armour. Look closely, the theory goes, and you will price risk accurately, negotiate protection, and avoid buying someone else's problem. In Indian M&A that account is incomplete. Diligence is armour with a blade turned inward: the law punishes the buyer who does not look, and the contract often punishes the buyer who does.
Section 19 of the Indian Contract Act lets a party avoid a contract induced by misrepresentation, but adds a sharp exception: the contract is not voidable if the deceived party had the means of discovering the truth with ordinary diligence. In a modern deal, the "means of discovering" usually sits in a virtual data room. Once a seller uploads thousands of documents, an unread board minute or an overlooked tax notice risks becoming the buyer's own failure rather than the seller's misstatement, a tension examined in commentary on Indian sandbagging law. So the rational buyer is pushed to read everything.
Then the contract reverses the incentive. Sellers routinely seek anti-sandbagging clauses barring claims for breaches the buyer knew about at closing, and disclosure letters that treat the entire data room as "fairly disclosed". Warranty and indemnity insurers, increasingly central to Indian deals, exclude known issues and matters revealed in diligence. Every red flag the buyer's lawyers identify is a flag the buyer can no longer claim on.
The result is a perverse equilibrium. Diligence exists to cure what economists call information asymmetry, the problem Akerlof described in the market for lemons. Yet the legal architecture rewards a calibrated ignorance: investigate enough to price the deal, but avoid formally "knowing" what you would later want to sue over. Advisers learn to write reports that flag without concluding. That is not diligence; it is the management of knowledge as a liability.
Indian law has not resolved the conflict. Some scholarship reads recent judicial practice as drifting towards a pro-sandbagging stance despite the text of Section 19, while many share purchase agreements remain silent on the point altogether. Silence, in this setting, is not neutrality. It is a litigation risk deferred.
The trap tightens as the nature of risk changes. Under the DPDP Rules, the substantive obligations on data fiduciaries apply from 13 May 2027, with penalties under the Act reaching up to ₹250 crore. An acquirer that closes today buys a target's legacy consent practices, its processor chains and its breach history.
These liabilities rarely live in documents. A defective consent flow lives in code, server logs and third-party SDKs. A privacy policy in the data room can be immaculate while the product quietly does something else. Traditional diligence, built for title deeds, ledgers and contracts, reads what a company says; data risk sits in what a company does.
This matters doctrinally. If technical privacy audits become market practice, a court may come to treat them as "ordinary diligence" for Section 19, so the buyer who skips one forfeits rescission. The buyer who commissions one acquires knowledge that anti-sandbagging clauses and insurance exclusions can turn against it. And the risks that actually materialise are regulatory: India now accounts for roughly a third of Asia-Pacific W&I claim notifications, with tax and compliance breaches dominating.
The trap is largely contractual, so drafting can loosen it. Four techniques deserve wider use:
An express pro-sandbagging clause providing that warranties are given independently of any investigation, so that a damages claim for breach of warranty stands apart from the Section 19 defence to rescission.
Specific disclosure only, against identified warranties, rather than deemed disclosure of the entire data room.
Ring-fenced specific indemnities for legacy data-protection non-compliance, with survival periods running well beyond May 2027.
A pre-signing technical privacy audit whose findings are priced through escrow or holdback, converting "known" risk into money rather than a forfeited claim.
None of this guarantees enforceability while Indian courts have yet to settle the interaction between knowledge, warranties and Section 19. But it at least aligns the contract with the purpose of the exercise. Due diligence should make buyers wiser, not weaker. A legal order in which the safest posture is not to know has quietly inverted the point of looking.
Author: Ayushi Dwivedi
Law Center 2, Delhi University
Sign in to join the discussion.
What India added, through Section 17(b), was something narrower and deliberate: the operator's statutory right to recover from a supplier whose defective equipment or services caused the accident.
Digital technologies can address some shortcomings of field-based verification. Remote sensors can measure forest cover and methane and other greenhouse-gas emissions faster and over a wider area than traditional field methods. Digital Measurement, Reporting and Verification (dMRV) can improve transparency while reducing costs. But digital tools bring their own challenges.
