Selling a Business and its Data

The impact of a sale can be influenced by the GDPR and Data Protection Act of 2018.

Every business that is sold has assets that establish its value. One of the most valuable of these is the customer and prospect lists together with other intellectual property. However, the database is the key asset within any sale/acquisition.

When considering the sale and purchase of a business, it is important to establish whether the data being sold with the company falls within the scope of data protection legislation. Understanding the compliance of the data is equally important.

Most buyers or their lawyers will seek reassurance by incorporating warranties into the sale agreement.

Data protection warranties

• A legal basis for processing has been established and appropriately documented.
• The seller is the data controller and is therefore entitled to transfer the data to the buyer. In certain cases, consent may be required from the data subjects contained within the dataset.
• There are no outstanding data Subject Access Requests relating to the use of the data and that no complaint is open with the Information Commissioner’s Office.

The buyer should complete their own appropriate due diligence. This can be done by asking to see copies of the information provided to data subjects. The company’s privacy notices are an obvious place to start. Internal policies should also be examined to ensure they have real meaning and actually deliver compliance to the various regulations.

Transfer of Shares

In the case of an outright sale of a dataset as an asset, the transfer of personal data from one controller to another will amount to processing under the applicable data protection legislation. Therefore, on completion of the sale, the buyer will become the data controller.

There is a legal requirement to inform the data subjects that their personal data is to be transferred to a new controller. An explanation as to why this is being done should be provided. The data subject must also be given the right to refuse the transfer of their data. If the buyer is relying on the seller to send out such notice, it is advisable that this is detailed in the sale agreement to avoid conflict post-sale.

If the sale of the database is part of a business sale by way of a share purchase, then the controller will remain the same. As part of the due diligence process, the buyer should be satisfied that data protection requirements are being met.

Therefore, if you are considering buying or selling a business and its data you may require specialist advice on data protection matters during the purchase or sale of a business. Therefore, please get in touch with us here or on 03333 22 1011.

We have helped many business sellers and buyers alike to avoid being caught out. We can discuss how our experience helping them can help you.