Data Center Investment Due Diligence: A Checklist

Data centers have captured significant attention on Wall Street, particularly among private equity (PE) investors. Thanks to their ability to offer steady cash flow and growing demand due to increased artificial intelligence (AI) adoption, data centers are receiving more investments from large PE firms.

But as firms increasingly explore data center investments, they must also understand their unique due diligence requirements. While these requirements can vary greatly — for example, based on the data center’s development stage — there are foundational elements that investors must evaluate before making an investment. 

Explore these considerations in our checklists:

BDO’s Data Center Center Due Diligence Checklist

Power Availability

With demand for AI increasing, investors should evaluate a data center’s power capacity and energy requirements

• Power supply. Assessing the age and performance of internal equipment, including transformers, switchboards, generators, distribution, safety devices, and back-up power supply can help firms determine whether upgrades are needed to handle AI workloads.
• Power capacity. Examine the facility’s current capacity and forecast future needs from increasing AI use. Is the data center equipped to scale operations as AI workloads increase over time?
• Contract terms and structure. What existing energy contracts does the data center have in place? Ideally, the facility should have a long-term energy contract, which reduces the risk of cost variability and service interruptions.

Cooling Capabilities and Environmental Impacts

AI chips generate significantly higher thermal load than other types of chips and can put tremendous strain on local water supplies and infrastructure, negatively impacting the communities where data centers operate — especially those in already water-stressed regions.

• Cooling method. What kind of cooling system does the data center use? Each method — liquid, air, immersion, evaporative, hybrid, or free cooling — has different impacts on the data center’s ability to accommodate AI’s high-density computing power. Liquid and immersion cooling, for example, are considerably more efficient than air-based systems.
• State of systems. Review the efficiency of a data center’s cooling equipment to help forecast maintenance costs, and in turn, profitability. Firms can request to review power usage effectiveness (PUE) ratios and maintenance logs for greater visibility during due diligence.
• Water consumption. Evaluate a data center’s water use and any consumption strategies the facility has in place, such as closed-loop liquid cooling systems and alternative cooling fluids. Large-scale data centers typically use millions of gallons of water daily due to cooling needs driven by AI workloads, which carry both operational and cost implications.
• Noise pollution. Assess a data center’s noise pollution from both its day-to-day operations as well as from back-up power generators. As many suburban areas are trying to keep data centers out of their communities due to excess noise and power consumption, it is crucial to identify and address noise pollution concerns before committing to an investment.

Workforce

Data centers often experience high turnover rates due to their high-pressure work environments and aging workforce. Because they are typically built in rural areas, data centers are also more susceptible to worker shortages. PE investors should evaluate a data center’s workforce needs and assess how they may evolve over time.

• Local talent. Consider the data center’s local talent pool. Can the available workforce address the facility’s cabling, equipment maintenance, and operational needs? If not, the data center may need to house workers from other areas on a temporary basis, mimicking similar arrangements in oil and gas operations, which can become extremely costly. Some organizations are identifying and developing talent via collaborating with local education partners.
• Workforce needs now and into the future. Understand how the data center’s workforce needs will change as its AI capabilities mature. For example, how many people does the data center need to employ to maintain its operations? Will the facility require new security personnel? What training investments might be needed? A data center in the early stages of AI adoption will have vastly different workforce needs than a data center with advanced AI infrastructure in place.
• Specialized talent. Data center workers with specialized skills — like advanced AI knowledge — are in high demand, and therefore, may expect higher compensation packages. Talent poaching has also become commonplace. Review the target data center’s compensation and benefits offerings, as well as broader recruitment strategies to attract and retain top talent. Consider the cost of turnover, availability of talent, and the competition when developing the talent philosophy used at each data center.

Security

A data center’s security directly influences the long-term viability and value of investment, as a breach — whether through a back door or a firewall — can result in catastrophic consequences.

• Physical facility protection. Assess a target facility’s defense-in-depth capabilities to manage access points and their vulnerabilities. Unauthorized data center access remains a risk, especially for colocation arrangements. A comprehensive security plan should be part of the due diligence process, with contemplation of the facility’s vehicle blockades, cage systems, door hinges, and other protective measures put in place to ensure building security. Data centers that serve higher-risk industries like critical infrastructure, defense, government contractors, or technology providers may need even more comprehensive investments.
• Cybersecurity. Review a data center’s digital defense capabilities, including the storage and access of identities and surveillance systems, along with incident response capabilities and after-action reports for recent incidents. The data center’s business model should drive associated control levels and an effective information security management system. A facility’s network monitoring practices and incident response procedures have a direct impact on tenants’ data protection and regulatory compliance.
• Disaster & recovery risks. Consider a data center’s environmental risk factors and their potential impacts on facility infrastructure. For example, is the facility in proximity to a disaster zone? What infrastructure does the data center have in place to withstand a severe weather event?

Regulatory Requirements

Data centers are heavily regulated, namely for their resource use and connection with other sectors that handle sensitive information, like healthcare and financial services. Before investing in a data center, understanding the facility’s regulatory requirements based on its current and prospective tenants will help maintain an accurate risk picture.

• State and local reporting requirements. Assess any state or local rules pertaining to a target location, as they can significantly impact reporting requirements and compliance costs. The State of Georgia, for instance, approved a rule in 2025 that allows power suppliers to charge data centers higher rates to protect customers from cost shifts.
• AI & cybersecurity compliance. As AI security is regulated by several national bodies and may be subject to U.S. confidentiality and integrity obligations, it is critical to verify that a data center maintains compliance with all in-scope regulations. Depending on the data center and its AI usage, these may include the Payment Card Industry (PCI) Security Standards, HIPAA, Financial Industry Regulatory Authority (FINRA) rules, among others. Investors must also ensure that the data center meets industry-standard cybersecurity requirements, such as ISO 27001 or NIST frameworks.
• Emerging regulations. Anticipate future regulations around alternative energy sources, particularly nuclear power, which is gaining traction as a data center energy solution. New compliance requirements in this area could impact operational costs and timelines.
• Third-party attestation. To verify that a data center meets all its necessary compliance requirements, request third-party attestation and certifications. SOC 1 and SOC 2 are the baseline documentation for most facilities, though additional certifications may be required depending on the data center’s tenants. For example, a data center hosting a healthcare tenant may need documentation to demonstrate compliance with HIPAA.

Real Estate Leasing

It is important to understand real estate leasing terms to accurately model a target data center’s cash flow stability.

• Lease terms. Consider prioritizing data centers with longer (e.g., 15+ years) and more favorable lease structures. A triple net lease (NNN) is ideal for a data center, as the tenant pays base rent plus the “net” of operating expenses, including property taxes, building insurance, and maintenance.
• Tenants. Verify the creditworthiness of existing or prospective tenants to ensure stable, long-term cash flows that justify the acquisition price. Investors must also consider what alternative uses exist for the facility should one or more tenants depart.
• Customer concentration risk. How many tenants does the data center have? Do they have tenants in more than one industry? Tenant base composition can reveal potential cash flow vulnerabilities and customer concentration risk.