From classified materials to classified adverts - National security scrutiny over Gumtree's personal data

On October 7, 2026, the UK Government issued a final order under the National Security and Investment Act 2021 (the "NSI Act") conditionally approving the acquisition of Gumtree.com Limited ("Gumtree") by FE International Limited, a wholly owned subsidiary of Chinese-headquartered 58.com Incorporated ("58.com").

The NSI Act allows the UK Government to scrutinize acquisitions that could give rise to national security risks, and to block, unwind or impose conditions on them where it considers it necessary. Gumtree, the well-known online classifieds platform, is not an obvious candidate for such scrutiny. The decision underscores the broadening scope of NSI Act reviews and the heightened scrutiny applied to China-linked acquirers. This Legal Update summarizes the key findings and practical takeaways for businesses and investors.

Key Findings from the Final Order

The published notice of the final order is brief but the following points are important to note:

• Acquisition approved subject to data-security conditions: The UK Government has approved the acquisition of 100% of Gumtree’s shares by 58.com (via FE International) subject to conditions requiring certain governance, operational and information security measures, including retaining existing data protections and establishing a dedicated Data Security Committee within Gumtree.
• National security risk linked to UK user data: The UK Government explicitly tied the national security risk to the access offered to UK user data: "remedy, prevent or mitigate the risks to national security relating to the access to and control of UK user data held by Gumtree." This frames access to sensitive personal data of UK users as a national security concern. The order does not specify the data in question, but Gumtree’s data holdings have grown since the acquisition with the launch of in-platform payment and delivery services in November 2025, which seem to bring payment, address and delivery data onto the platform.
• Acquisition already completed before intervention: The acquisition was completed on September 30, 2024, with 58.com gaining control of Gumtree through FE International. Under the NSI Act, where a transaction is not notified, the Secretary of State may call it in for review up to five years after the trigger event, provided this is done within six months of becoming aware of it. The final order, published more than two years later on October 7, 2026, reflects that call-in and review risk extends far beyond closing.

Wider context: lessons from the 2025–26 Annual Report

The Gumtree decision does not sit in isolation. As set out in the UK Government’s NSI Act Annual Report for 2025–26, published on 14 July 2026, there has been a continued increase in the volume of screening activity conducted under the NSI Act, with 1,324 notifications received (up 15% on the previous year) and 60 call-in notices issued. Of the nine final orders made during the year, three were associated with acquirers linked to China (the second-largest origin of investment for final orders) and 30% of all call-in notices involved acquirers associated with China.

The Gumtree decision also reflects a growing focus on personal data as a national security concern. In December 2025, the Government imposed a final order on the acquisition of recruitment firm Investigo Limited by Career International AP (Hong Kong) Limited, citing risks relating to "the collection of, and access to, personally identifiable information held by Investigo."

Key takeaways for deal makers

The Gumtree decision, read alongside other recent cases and the latest Annual Report, carries several practical lessons for deal makers when planning, structuring and timetabling UK transactions:

• NSI Act scrutiny extends beyond the 17 specified sectors: The Gumtree decision, following the Investigo decision in December 2025, shows that national security concerns are not confined to the 17 sensitive areas of the economy listed in the mandatory notification regime. The Government’s express focus on UK user data as the source of national security risk suggests that any business holding significant volumes of personal data could attract scrutiny, even where the target’s activities fall outside the specified sectors subject to mandatory notification. Deal makers should therefore build the target’s data holdings, not just its core activities, into NSI Act due diligence, looking at the volume and type of personal data held.
• Heightened scrutiny for acquirers linked to certain jurisdictions: Although the NSI Act applies to all acquirers regardless of nationality, the Gumtree decision, involving Chinese-headquartered 58.com, together with the UK Government’s annual reporting data, reflects that investors associated with certain jurisdictions face a materially higher risk of intervention. Where the buyer has links to these jurisdictions, deal makers should factor this into risk assessments, timetables, and long-stop dates from the outset, and consider whether the buyer is prepared to offer data-security commitments of the kind accepted in Gumtree.
• Apparently “benign” targets can still trigger NSI Act intervention: Gumtree is a household-name classifieds platform with no obvious connection to defense, critical infrastructure, or sensitive technology. The decision demonstrates that the Government will intervene where it identifies a risk, including from the target’s data assets, even where the target entity would not, on its face, appear to raise national security concerns. Deal makers should assess whether a voluntary notification is prudent, recognizing that intervention more than two years after completion—as in Gumtree—can leave a buyer subject to post-closing conditions it did not price into the deal.

If you would like to discuss the issues raised in this Legal Update, or how they may affect your business, please get in touch with the authors, or your usual Mayer Brown contact.