data protection risks in saas mergers