Insights / Corporate & Commercial

Selling Your Data Centre to Private Equity: What Their Due Diligence Will Actually Focus On

By Clay & Associates Advocates · 6 min read ·

A technician working on network cables in a server room

When an infrastructure private equity fund buys a data centre, its data centre due diligence concentrates on five areas that go beyond the financial statements and litigation history a generalist buyer would review: the power arrangements, the colocation contracts, the licensing position and what happens to it on a sale, the physical condition of the plant, and data protection compliance. Several of these turn on specific Kenyan rules, and a seller who can answer with documents rather than summaries negotiates from a stronger position.

Power arrangements and on-site generation

Power is a central input for a data centre, so a buyer will ask for the actual power supply or bulk supply agreement, not a summary: the tariff structure, the remaining term, any mechanism for passing through tariff changes, and what happens to the arrangement on a change of control. Those are contract questions, and the answers depend on the document.

On-site generation raises a statutory question. Section 117 of the Energy Act, 2019 requires a person who wishes to carry out the generation, exportation, importation, transmission, distribution and retail supply of electricity to apply for a licence to the Authority, but provides that a person does not require any authorisation to generate electrical energy for own use of a capacity not exceeding one megawatt. Section 118 makes carrying out an electricity undertaking without a licence an offence, punishable by a fine of not less than one million shillings or imprisonment for not less than one year, or both. A facility with substantial standby generation should therefore establish which side of the one megawatt line each installation sits, and whether the capacity is for own use. A buyer who finds an unresolved licensing question on a large generator installation will price it in or make it a completion condition.

The colocation book is read like a cash-flow portfolio

In data centre due diligence, an infrastructure buyer maps the tenant base by revenue concentration, remaining term and renewal likelihood. A facility with three tenants on short remaining terms is valued very differently from one with a diversified book on long agreements, even at the same current revenue. Expect the fund to ask for the signed agreements and to test, clause by clause, whether a tenant can terminate or renegotiate on a change of control or assignment. If every large tenant can leave when you sell, the asset is much harder to underwrite. These are commercial and contractual points rather than statutory ones, so they can be prepared well before a sale process starts.

Licensing, and what happens to it in the sale

The structure of the deal decides the licensing consequence. In a share sale the licence stays with the company, but the Kenya Information and Communications (Licensing and Quality of Service) Regulations, 2010 still apply. Regulation 9(2) requires a licensee to notify the licensing regulator of any proposed change in ownership, control or proportion of shares at least thirty days before the change is effected. A change in shareholding exceeding fifteen per centum of the issued share capital, or the acquisition by an existing shareholder of at least five per centum of additional shares, requires the regulator’s prior written consent, which it must communicate within thirty days of receiving the request. In an asset sale, regulation 10 provides that a licensee shall not transfer or assign a licence without the regulator’s written consent, and the regulator may treat the application as it would an application for a new licence. The text cited is the consolidated version on Kenya Law dated 31 December 2022, and later amendments should be checked.

The licence category itself is also under review. The Communications Authority’s open consultations include a “Proposed Licensing Framework for Data Centres”, which would create a standalone data centre licence in place of regulating co-location data centres under the Network Facilities Provider Tier 2 licence. A sophisticated buyer will ask how your licensing basis is expected to change, and a seller who cannot answer clearly looks less in control of the regulatory position. Our article on data centre exit routes in Kenya compares the licensing and listing consequences of each exit.

Physical condition and remaining equipment life

Unlike a typical technology acquisition, much of an infrastructure buyer’s diligence happens on site: the condition and remaining service life of the cooling plant, the age of UPS and switchgear against manufacturer warranty and replacement schedules, and whether the build matches the facility’s own technical documentation and any published standard it claims to meet. A facility marketed as meeting a particular uptime or redundancy standard should expect the buyer’s engineers to verify the claim physically.

Data protection exposure

The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 make registration under section 18 of the Data Protection Act mandatory for every data controller and processor, subject to the exemption in regulation 13: an entity is exempt only where its annual turnover or revenue is below five million shillings and it has fewer than ten employees. The Third Schedule separately requires registration by those processing personal data for listed purposes, which include telecommunications network or service providers. Whether a given data centre falls within that heading depends on how its licence and services are characterised, so confirm your registration status instead of assuming it.

Section 50 of the Act allows the Cabinet Secretary to prescribe, on grounds of strategic interests of the state or protection of revenue, certain nature of processing that must be effected only through a server or data centre located in Kenya. A buyer will also check whether any customer contract commits the facility to in-country storage, since that shapes what the buyer is acquiring the right to promise its own future customers.

Preparing for data centre due diligence before a buyer is at the table

Each category can be prepared in advance: a documented power arrangement, a colocation book whose change-of-control clauses do not let tenants exit at the worst moment, a clear answer on where your licensing sits and where it is heading, a confirmed data protection registration, and maintenance records that match your claims.

How We Can Help

Clay & Associates Advocates can advise on the licensing and regulatory-consent questions a data centre sale raises, review your registration and compliance position ahead of a buyer’s data centre due diligence, and help assemble the documents a fund will request. Our regulatory compliance practice advises on licensing and data protection obligations, and you can reach us through the contact page.

Sources: Energy Act, 2019, sections 117 and 118; Kenya Information and Communications (Licensing and Quality of Service) Regulations, 2010, regulations 9 and 10; Communications Authority of Kenya, open consultations; Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021; Data Protection Act, 2019, section 50.

Frequently asked questions

Does a data centre need an EPRA licence for its backup generators?
Section 117 of the Energy Act exempts generation for own use of a capacity not exceeding one megawatt from the licensing requirement. Larger installations, or generation that is not for own use, need to be assessed against the licensing requirement, and operating without a required licence is an offence under section 118.

What happens to the Communications Authority licence if we sell the shares?
The licence stays with the company, but regulation 9 of the 2010 Licensing Regulations requires thirty days’ notice of a proposed ownership change, and prior written consent where the change exceeds fifteen per centum of the share capital or an existing shareholder acquires at least five per centum more.

Must a data centre register with the Data Protection Commissioner?
Registration is mandatory for controllers and processors unless the regulation 13 exemption applies, which requires turnover or revenue below five million shillings and fewer than ten employees. The Third Schedule also lists telecommunications network or service providers.

&

Clay & Associates Advocates
This article is general information, not legal advice. For advice on your matter, speak to counsel.

Related Insights

Discover more