How can data become a national security risk in UK M&A? Lessons from the NSIA intervention in Gumtree

15 Oct, 2026

Summary

The UK Government has long worried about the national security risks of data and it is now acting on them using the National Security and Investment Act 2021 (NSIA). It recently placed conditions on the Gumtree takeover two years after a China-linked buyer completed it. With no dedicated data security law, NSIA is the tool the Government has used so far which makes M&A the activity most exposed to intervention on data grounds. Only some data-rich deals must be notified and with call in powers lasting up to five years after completion, this creates a long tail of unpredictable risk. Deal teams should therefore assess data risk early by mapping the data a target holds and who can access it, testing the buyer and financing chain for links to high-risk countries, deciding early whether to notify voluntarily, and building mitigations into the deal structure.

Gumtree – a national security risk?

Data is a growing national security risk in UK deals involving businesses that hold large amounts of personal data, particularly where the buyer has links to a high-risk country, as illustrated by the Government’s most recent use of the National Security and Investment Act 2021 (NSIA).

On 30 September 2024, Gumtree was acquired by a Chinese company. Since then, the UK household-name, which offers local classified ads for anything from old furniture to used tractors, has been run by China’s largest online classified ads marketplace. Users will probably not have noticed the difference.

Last week, just over two years later, the UK Government retrospectively intervened in the acquisition, approving it under NSIA subject to certain conditions. The final order was the first imposed by Business Secretary Jonathan Reynolds, the new decisionmaker since the Investment Security Unit (ISU) moved to the Department for Business, Innovation, Science and Trade earlier this year.

The final order requires the company under its not-so-new ownership to “meet certain requirements relating to governance, operations and information security, including retaining certain existing data protections and implementing a Data Security Committee within Gumtree”.

This retrospective calling in of a company in a traditionally non-sensitive part of the economy raises two interesting questions: what explains the decision, and what does it reveal about how the NSIA tool fits within the UK’s data protection environment?

Data as a risk vector

While Gumtree data is not immediately sensitive in its own right – names, contact details, listings and messages etc – aggregation of personal data can create risks. The National Cyber Security Centre, the UK’s technical authority for cyber security and part of GCHQ, indicates that grouping related personal data together creates a richer digital picture of people’s lives, increasing both the security risks and its attractiveness to an attacker.

Government concern about the security risks of UK data going abroad is not new. But to date, it has struggled to determine the exact risks it needs to manage or to persuade itself that the risk is acute enough to drive action to fill any gaps in law. The Government’s December 2025 response to its call for evidence on ‘data brokers and national security’ acknowledged the existence of risk and committed to assessing the role of UK GDPR in national security but it has not followed up since.

Other countries are dealing with this exact same issue. The US has led the charge in thinking about the national security risks relating to data, in part because it was coming from a lower baseline of protection as it does not have federal-level data regulations similar to GDPR provisions. In 2019, CFIUS – the US equivalent of NSIA – ordered a Chinese company to divest its ownership of dating app Grindr for data-related reasons.

The US then passed the Protecting Americans’ Data from Foreign Adversaries Act (“PADFAA”) in 2024 and, following Biden administration executive action, issued the U.S. Department of Justice Bulk Data Rule in early 2025. Both severely restrict data transactions outside of the US to specific countries. How different countries across the EU draw the regulatory line, where national security is a national competency but wider data protection is led by the Commission, remains to be seen.

NSIA – an imperfect tool for data protection

UK data protection rules do already govern data leaving the country, but they focus on protecting privacy rights, not security and therefore have limits for national security purposes. The Gumtree final order sits in this uncertain space. The Government was most likely worried what the change of ownership might mean for how Gumtree holds, secures, and shares its data. That is, admittedly, what NSIA was designed for. Using NSIA has other appeals: it includes strong asset powers which specifically include databases and allows the bodies with the relevant intelligence to participate in a cross-Government security assessment.

But clear policy drawbacks exist. Outside of NSIA mandatory notification sectors, you are not required to tell the Government about a deal, so it might often find out too late. Mandatory notification requirements for data apply only to specific infrastructure roles and to software providers whose products give ongoing privileged access to customer data. It does not apply to businesses like Gumtree simply because they hold large datasets. There is also a legacy problem. Some data-rich businesses may already have changed hands before NSIA existed, which leaves them outside its reach.

For two years after the acquisition of Gumtree, the risks around UK user data were most likely an ongoing problem, and the data may already have moved. Once the Government did become aware, it presumably decided that the extant risks outweighed the market uncertainty that a retrospective intervention would create. That is a hard call, and not one businesses and investors can easily price in.

Extending mandatory NSIA notification to data-rich deals outside of the sensitive sectors would go some way in fixing this timing problem, but it would sweep in a huge slice of the economy and add yet more regulation at a time the Government is seeking to reduce this where it can. A standalone regime is difficult too: it would need to name specific countries, which governments often avoid for diplomatic reasons, or cover the whole world and catch legitimate data sharing.

What does this mean for investors?

The retrospective Gumtree intervention may signal that the Government’s tolerance for data-related national security risk is falling. The Government’s use of the NSIA also shows that M&A activity is the most exposed to intervention. The risk is most acute where the acquirer or deal financier is from, or has links to, a country the UK considers high risk.

The Government’s main challenge is spotting acquisitions of data-rich businesses at the right time, particularly outside the mandatory notification sectors. While NSIA offers a strong backstop as the Government can call in deals for up to five years after completion, the consequence is greater uncertainty for businesses, which currently bear the cost of this policy challenge.

Companies should assess and manage this risk in any transaction where data is a significant, sensitive or high value asset including by:
Considering whether to notify voluntarily under NSIA. Notifying brings certainty early, but it also raises the chance of intervention, because it removes the political awkwardness for the Government of acting after the deal has completed.
For buyers, proactively mapping the security implications of the data the target holds, including how it is managed and who can access it.
For sellers, preparing a data map and a clear account of access and controls before launch, so buyers and the Government can see the position early.
Considering which data-related mitigations might belong in the deal structure from the start. The Gumtree decision itself points in this direction, since the final order retained some of the company’s existing data protections.

This blog was written by Flint Manager Fergus Opdebeeck Wilson, Partner James Snook, and Director Verity Ryan. Fergus, James and Verity advise buyers and sellers on how data security risks can shape a deal. That ranges from early diligence on an asset’s data exposure and likely screening outcome, to advice on engaging with government and designing the governance and mitigation package.