Coming back to this one a few years on, the data protection point has moved a fair bit. It is now UK GDPR rather than the EU version, and the Data (Use and Access) Act 2025 has changed some of the rules again, so anyone doing due diligence should work from the ICO's current guidance rather than a 2020 checklist. Worth correcting one thing too: the "automatic £1,000 per customer" figure was never real. Compensation has to be proven, and courts have shown little patience with low-value claims. Poor data handling is still a genuine liability to price into a deal, just not a guaranteed payout.
What nobody raised is the mechanics. A merger between two small UK firms usually means one company acquiring the other's shares or assets. A share-for-share exchange with advance HMRC clearance avoids anyone landing a Capital Gains Tax bill on day one. If either business has staff, TUPE applies on an asset purchase, so employment contracts transfer as they stand. An earn-out tied to retained customers is the standard way to stop the outgoing owner's clients drifting off once they step back.
Did anyone here actually go ahead with a merger after this thread? Would be interesting to know whether the paperwork or the culture clash turned out to be the harder part.