UK National Security and Investment Act: personal data in the spotlight in Gumtree deal

The UK Government issued a final order under the National Security and Investment Act 2021 ("NSIA") on 7 October 2026 conditionally approving the 2024 acquisition of Gumtree.com Limited by FE International Limited, a wholly owned subsidiary of Chinese online classified advertisements company 58.com.

This case is a reminder that transactions which provide sensitive acquirers with access to personal user data of UK citizens may well give rise to national security concerns and attract intervention, absent any other apparent national security concerns and despite UK personal data being outside of the scope of the mandatory NSIA regime and protected under other legal regimes, such as the UK General Data Protection Regulation. Further, that the Investment Security Unit ("ISU") can review, call-in and impose conditions (including prohibition) on non-notified transactions within the broad remit of the NSIA long after completion.

This article highlights considerations relevant to acquisitions of data-rich businesses under the NSIA.

Now Reading

Personal UK user data

Gumtree is an online classified ads and community platform on which individuals buy and sell household items, cars, property, pets, local services and more, and 58.com operates China's largest online marketplace for classified ads and enables local business and consumer users to connect, share information and carry out transactions.

The specified national security concern identified by the Government in this transaction relates to "access to and control of UK user data held by Gumtree". The user data held by Gumtree includes personal identity and contact details, advertisement details (e.g. photos, postcodes and listing descriptions), technical financial and transaction data (e.g. payment details processed through third party providers), and user activity data (e.g. ads viewed, favourite ads, saved searches, messages and ratings/reviews).

To address that risk, the order imposes conditions on 58.com relating to governance, operations and information security. These include retaining certain existing data protection mechanisms already in place and implementing a "Data Security Committee" within Gumtree, consistent with other recent NSIA orders under which the Government has imposed restrictions on handling data and information.

For data-rich businesses being acquired, the combination of (i) the nature, scale and accessibility of the UK user data over which access and control is being acquired (even where apparently non-sensitive and not obviously related or relevant to national security), and (ii) the identity and nature of the buyer, is key to consider in assessing both the approach to engaging with the ISU and the risk of intervention under the NSIA.

The latest NSIA Annual Report indicates that more than 30% of each of the final notifications issued and the final orders made in 2025/26 involved acquirers associated with China. In addition, two of the nine final orders (both involving acquirers associated with China) imposed data-handling requirements to mitigate national security risks arising from the collection of and access to data relating to UK individuals.

Access to and control over data on UK citizens has always been a known factor in the Government's assessment of national security risk. Whilst personal data is not in and of itself within scope of a mandatory sector under the NSIA (meaning acquisitions of targets which hold personal data (and do not have other sensitive activities) are not subject to mandatory prior approval under the NSIA), the voluntary notification form expressly requires information about whether a target is used to gather or hold data on UK citizens.

The NSIA operates a hybrid mandatory and voluntary regime. See our previous briefing: The UK's National Security and Investment Act 2021: what you need to know | Travers Smith.

However, the increasingly turbulent geopolitical climate combined with the increased global focus on access to and control over consumer data online and through the use of artificial intelligence, may well result in increased measures to protect data of UK citizens through intervention under the NSIA in relation to apparently non-sensitive targets.

In the EU, under the recently adopted EU Foreign Direct Investment Screening Regulation (which is expected to come into effect in January 2028), potential effects on "the protection of sensitive information, including personal data…in particular with regard to the ability of the foreign investor to access, control and otherwise process such information" is a factor in determining whether a foreign investment is likely to negatively affect security or the public order. There are also several EU Member States which have foreign direct investment screening regimes that include access to sensitive personal information as a ground for mandatory notification and approval.

Retroactive Government intervention

The transaction completed on 30 September 2024, just over two years before the NSIA final order was imposed.

Gumtree presumably did not fall within scope of any of the 17 sensitive mandatory sectors – on that basis 58.com would have been under no obligation to seek approval under the NSIA – and, given the Government only has the power to call-in a transaction not notified to it for a period of 6 months after becoming aware of it, the transaction was also presumably not proactively notified to the ISU under the voluntary regime at the time.

The Government has the power under the NSIA to call-in a transaction for up to five years post-closing, and up to 6 months after becoming aware of it.

Given the deal appears to have not attracted much publicity at the time of the acquisition, the ISU may well have only become aware of it much later and following news articles reporting on the acquisition having quietly taken place.

The Government clearly remains prepared to look at historic completed transactions where national security concerns arise, which should be factored into decision-making on approach to engaging with the ISU in relation to deals which may raise concerns but do not require notification.

Practical takeaways

This case is a timely reminder that even the acquisition of apparently non-sensitive businesses can trigger national security concerns, depending in part on the volume, nature and accessibility of the personal data of UK citizens being acquired.

Acquirers of data rich businesses, and especially those from jurisdictions with heightened national security concerns, are advised to carefully consider whether a voluntary UK NSIA notification is merited in the circumstances, alongside securing appropriate contractual protections relating to the extent of any potential Government intervention.

Our Competition Team regularly advises on NSIA notifications and national security considerations across a range of transactions. Please get in touch if you would like to discuss.

Read Ingrid Hodgskiss Profile