Can You Transfer Customer Data When Selling Your Business?

When you're selling a business, there's usually a lot to think about. Between finalising contracts, agreeing on a price and making arrangements for the handover, it's easy for certain details to get overlooked. Sometimes, those smaller details can raise much bigger legal questions later on.

One of those details is customer information.

Over time, your business might have collected hundreds or even thousands of customer records, from names and contact details to purchase histories and account information. These records can be valuable to a potential buyer, especially if they're planning to continue running the business.

But can you simply hand over that information when the sale goes through? Do customers need to be notified, or even give their consent?

In Australia, privacy laws can affect how customer information is shared during a business sale, including what you can disclose to a potential buyer before the sale is finalised.

Let's look at what sellers and buyers need to consider.

Can You Transfer Customer Data When Selling a Business?

Yes, customer data can form part of a business sale. However, whether you can legally transfer particular records depends on the type of sale, the information involved and your existing legal obligations.

There are two common ways a business can be sold:

• Share sale: The buyer purchases shares in the company. While ownership changes, the company remains the same legal entity and generally continues holding its customer information.
• Asset sale: The buyer purchases particular business assets, potentially including customer contracts and databases. This may involve transferring customer information to a different legal entity.

For example, selling shares in your company doesn't necessarily involve transferring customer information outside the company. However, selling business assets to another company may require a separate disclosure of customer records.

This distinction matters because different privacy obligations can arise depending on how the transaction is structured.

The transaction should also be properly documented through an appropriate Share Sale Agreement or Asset Purchase Agreement.

What Privacy Laws Apply When Selling a Business?

The main legislation to consider is the Privacy Act 1988, which regulates how certain Australian businesses collect, use, disclose and protect personal information.

Businesses covered by the Act generally need to comply with the Australian Privacy Principles (APPs), including rules concerning the disclosure and security of customer information.

However, not every business is automatically covered.

Does the Privacy Act Apply to Small Businesses?

Many Australian businesses with annual turnover of $3 million or less are exempt from the Privacy Act. However, exceptions apply, including for certain health service providers and businesses that trade in personal information.

Trading in personal information generally involves collecting or disclosing someone's personal information in exchange for a benefit, service or advantage, without their consent or another applicable legal authorisation.

The Office of the Australian Information Commissioner (OAIC) distinguishes between selling a whole business and selling assets containing personal information.

For example, selling shares in a company while customer information remains within that company isn't, by itself, trading in personal information. However, selling assets that include customer information may fall within these provisions.

This means a small business shouldn't automatically assume it can transfer a customer database without considering its privacy obligations.

Additional requirements may also apply where sensitive information, such as medical records, is involved.

Can You Share Customer Information With a Potential Buyer Before the Sale?

Privacy obligations can become relevant well before a business sale is completed, particularly during due diligence.

A potential buyer may want to review financial records, customer agreements and sales histories to understand what they're purchasing. However, this doesn't automatically entitle them to access identifiable customer information.

Imagine you're selling a service business with 500 regular customers. A buyer wants to know how many customers return each month and how much revenue those relationships generate.

You may be able to provide that information without revealing individual names or contact details.

The OAIC recommends using aggregated or de-identified information where possible during due diligence.

Where identifiable information needs to be shared, the seller should first consider whether disclosure is legally permitted. Existing customer contracts may also contain confidentiality obligations or restrictions on sharing information.

Appropriate safeguards might include a Non-Disclosure Agreement, secure data rooms and restricted access to documents. However, confidentiality arrangements don't automatically authorise an otherwise unlawful disclosure.

Buyers also need to be careful. Taking copies of documents containing personal information can amount to collecting that information under the Privacy Act.

What happens if the sale doesn't go ahead?

If negotiations fall through, the prospective buyer shouldn't simply retain the customer records it obtained. The OAIC recommends returning or destroying personal information collected during due diligence once the process is complete.

Do You Need Customer Consent or Have to Notify Them?

Consent and notification are different legal requirements. Consent involves obtaining a customer's agreement to particular handling of their information, while notification involves informing them about how their information is collected or handled.

Depending on the circumstances, one, both or neither may be required.

When Is Customer Consent Required?

Customer consent isn't automatically necessary whenever a business is sold.

Under APP 6, businesses covered by the Privacy Act generally cannot disclose personal information for a secondary purpose unless the individual consents or an applicable exception permits the disclosure.

For example, an exception may apply where the customer would reasonably expect the disclosure and the secondary purpose is related to the original purpose of collection. Stricter requirements apply to sensitive information.

Businesses should consider why the information was collected, what customers were told and how the buyer intends to use it.

For example, transferring records so a buyer can continue providing an existing subscription service may raise different considerations from transferring those records for unrelated advertising.

It's also worth reviewing your existing Privacy Policy. However, simply mentioning business sales in a privacy policy doesn't necessarily establish valid consent.

Does the Buyer Have Privacy Obligations Too?

Where the Privacy Act applies, the buyer may have its own obligations when collecting personal information.

Under APP 3, organisations generally need to ensure the personal information they collect is reasonably necessary for their functions or activities, with additional requirements for sensitive information.

A buyer may need customer contact details to continue providing services, but that doesn't necessarily justify collecting every record the seller has accumulated.

Both parties should therefore consider what information genuinely needs to be transferred.

When Do Customers Need to Be Notified?

Under APP 5, organisations covered by the Privacy Act generally need to take reasonable steps to notify individuals, or ensure they're aware of relevant matters, when collecting personal information.

Where a buyer collects customer records from a seller, this may include explaining who is collecting the information, why it's being collected and how customers can access the buyer's privacy policy.

Notification generally needs to occur before or at collection, or as soon as practicable afterwards if earlier notification isn't practicable.

Not every business sale requires the same notification process. However, if your existing privacy policy doesn't mention disclosures associated with a business sale, it's worth reviewing the position before proceeding.

Importantly, notifying customers doesn't automatically mean you have their consent to transfer their information.

What Should the Business Sale Agreement Say About Customer Data?

A Business Sale Agreement sets out the terms of the transaction, including what's being sold and each party's responsibilities.

Where customer information is involved, the agreement should address how those records will be transferred and protected.

Depending on the transaction, this might include:

• Scope of the transfer: Which customer databases and records are included or excluded.
• Privacy compliance: Each party's responsibilities for meeting applicable legal requirements.
• Consent and notifications: Who must obtain necessary permissions or provide notices, including any steps required before completion.
• Security and handover: How records will be transferred and who can access them.
• Warranties and indemnities: How risks relating to privacy compliance, previous data breaches or other issues are allocated.
• Retention and deletion: What information the seller may retain and what must be returned or deleted.

These provisions can help avoid uncertainty about what the buyer is entitled to receive and what the seller must do.

It's also important to distinguish customer information from customer contracts. Transferring customer records doesn't automatically transfer the contractual right to continue providing services. Depending on the existing agreements, an assignment or novation may be necessary.

If information will be disclosed to an overseas recipient, additional privacy requirements, including APP 8 where applicable, may also need consideration.

Can the Buyer Use the Customer Database After the Sale?

Receiving customer information doesn't automatically give the buyer unrestricted permission to use it however they choose.

The buyer may need to consider the original purpose of collection, existing customer expectations and any privacy obligations applying to its business.

For example, receiving customer details to fulfil outstanding orders doesn't necessarily authorise using those details for unrelated purposes.

Can the Buyer Use Those Details for Marketing?

Marketing is particularly important when a business sale includes email lists or customer contact details.

Under the Spam Act 2003, businesses sending commercial electronic messages generally need appropriate consent, accurate sender identification and a compliant unsubscribe facility.

Consent can be express or, in certain circumstances, inferred from an existing relationship. However, a one-off purchase doesn't automatically establish permission to receive marketing emails.

Imagine you purchase an online retailer with 2,000 customer email addresses.

You might want to send promotional emails advertising your products. Before doing so, you'll need to establish whether the existing marketing permissions support those messages.

The buyer should also check whether reliable records of consent are available. Acquiring a customer database doesn't automatically mean acquiring permission to market to everyone on it.

What Happens to Customer Records After Completion?

Once the sale is completed, both parties may still have responsibilities concerning customer information.

For the buyer, this includes securing the records, limiting access to authorised people and ensuring its privacy practices accurately reflect how the information will be handled.

For the seller, an important consideration is what happens to any records remaining in their possession.

If the customer database formed part of the sale, the seller shouldn't assume they can keep a copy or continue using it for another business. The sale agreement may require certain records to be deleted, access to customer systems to be removed and the handover to be confirmed.

However, some information may legitimately need to be retained for tax, accounting or other legal purposes.

Where APP 11 applies, businesses must generally take reasonable steps to destroy or de-identify personal information they no longer need for a permitted purpose, subject to relevant exceptions.

The important thing is to establish what information can remain with the seller, why it's needed and what restrictions apply to its continued use.

Need Help With the Legal Side of Selling Your Business?

Customer information can be a valuable part of a business sale, but transferring it involves more than handing over a database. It's important to understand your privacy obligations, check whether consent or notification is required and ensure the sale agreement properly addresses the handover.

Sprintlaw's experienced lawyers can assist with preparing or reviewing business sale agreements, privacy policies and related legal documents.

If you're preparing to sell or purchase a business, contact us at team@sprintlaw.com.au or call 1800 730 617 to discuss how we can help.