Can You Transfer Customer Data When Selling Your Business?

When you're selling a business, there's usually a lot to think about. Between finalising contracts, agreeing on a price and arranging the handover, it's easy for certain details to get overlooked. Sometimes, those smaller details can raise much bigger legal questions later on.

One of those details is customer information.

Over time, your business might have collected hundreds or even thousands of customer records, from contact details and purchase histories to account information and ongoing service agreements. These records can be valuable to a potential buyer, especially if they're planning to continue running the business.

But can you simply hand over that information when the sale goes through? Do customers need to be informed, or even give their consent?

In the UK, data protection laws can affect how customer information is shared during a business sale, including what can be disclosed before the transaction is completed.

Let's look at what sellers and buyers need to consider.

Can You Transfer Customer Data When Selling a Business?

Yes, customer data can form part of a business sale. However, transferring it must comply with applicable data protection laws and any existing contractual obligations.

The structure of the sale can make a difference.

In a share sale, the buyer purchases shares in the company. Although ownership changes, the company generally remains the same legal entity and continues holding its customer information.

In an asset sale, the buyer purchases particular business assets, potentially including customer databases, contracts and intellectual property. This may involve transferring personal data to a different legal entity.

This distinction matters because the organisation responsible for deciding how and why customer information is used, known as the data controller, may change following an asset sale.

A share sale doesn't necessarily involve a change of controller, although the company's handling of personal data must still comply with data protection law.

What Data Protection Laws Apply When Selling a Business?

The main legislation to consider is the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

These laws regulate how businesses collect, share, use and protect personal data. They can apply to businesses of all sizes, including startups and small businesses.

One of the central requirements is that personal data must be processed lawfully, fairly and transparently.

This means a seller can't assume that customer information can be transferred simply because it's included in the business sale. The buyer must also consider whether it can lawfully receive and use the information.

What Lawful Basis Can You Rely On?

Under Article 6 of the UK GDPR, businesses generally need a lawful basis for processing personal data, including sharing it with another organisation.

Depending on the circumstances, relevant lawful bases may include legitimate interests, contractual necessity, consent or compliance with a legal obligation.

For example, legitimate interests may sometimes provide a lawful basis for sharing customer information during a business sale. However, the business must assess whether the disclosure is necessary and whether its interests are overridden by the rights and interests of the individuals involved.

Contractual necessity may also be relevant where particular processing is genuinely necessary to perform a contract with a customer. Simply having customer contracts doesn't automatically justify transferring every associated record.

Where special category data, such as health information, is involved, additional requirements under Article 9 may apply.

The important thing is to identify and document an appropriate lawful basis before sharing personal data.

Can You Share Customer Data With a Potential Buyer Before the Sale?

Data protection obligations can become relevant before the sale is completed, particularly during due diligence.

A prospective buyer may want to inspect customer agreements, sales records or subscription histories to assess the value of the business. However, they don't necessarily need access to every customer's personal details.

For example, imagine you're selling a subscription business with 800 active customers. A buyer wants to know how many customers renew each year and how much recurring revenue the business generates.

You may be able to provide this information without revealing individual customer identities.

Where identifiable personal data genuinely needs to be shared, the parties should establish a lawful basis and consider appropriate safeguards.

These might include a Non-Disclosure Agreement, secure data rooms or restricted access to particular documents. However, confidentiality arrangements don't replace UK GDPR requirements.

Existing customer agreements may also contain confidentiality obligations that need to be considered before sharing information.

What happens if the sale doesn't go ahead?

If negotiations fall through, the prospective buyer shouldn't assume it can keep the customer information received during due diligence. The parties should establish what must be returned or securely deleted, while accounting for any lawful retention requirements.

These arrangements should ideally be agreed before confidential records are shared.

Do Customers Need to Consent to Their Data Being Transferred?

Not necessarily.

A common misunderstanding is that businesses always need customer consent before transferring personal data. However, consent is only one of the lawful bases available under the UK GDPR.

Where a buyer intends to continue providing existing services, another lawful basis may be available, depending on the circumstances.

The parties still need to consider why the information was originally collected, what customers were told and whether the proposed transfer is fair and lawful.

Your existing Privacy Policy can be particularly important here.

If customers were told their information would only be used for a particular purpose, transferring it to another organisation for a substantially different purpose may raise additional concerns.

Simply updating the privacy policy to mention business sales doesn't automatically make an otherwise unlawful transfer permissible.

Where consent is relied upon, it must meet UK GDPR requirements, including being freely given, specific, informed and unambiguous.

Do You Have to Notify Customers When the Business Is Sold?

Even where consent isn't required, businesses may still need to inform customers about changes to how their personal data is handled.

The UK GDPR contains transparency requirements under Articles 13 and 14.

Where a buyer obtains personal data from the seller rather than directly from the customer, Article 14 generally requires the buyer to provide relevant privacy information within a reasonable period, and no later than one month, unless an exception applies.

If the buyer contacts a customer or discloses their information to another recipient earlier, the relevant information may need to be provided at that point.

A privacy notice may explain who the new controller is, why the information is being processed, the lawful basis being relied upon and how individuals can exercise their data protection rights.

The seller should also consider whether its own transparency obligations require customers to be informed about the proposed disclosure or changes to the handling of their information.

Importantly, informing customers about a business sale isn't the same as obtaining their consent. Providing a notification doesn't automatically establish a lawful basis for transferring their data.

What Should the Business Sale Agreement Say About Customer Data?

A Business Sale Agreement should address more than the purchase price and assets being transferred.

Where personal data is involved, the agreement should establish how the information will be handled before, during and after completion.

Depending on the transaction, this may include:

• Scope of the transfer: Which customer records and databases are included, and what should be excluded.
• Data protection compliance: Each party's responsibilities for meeting relevant legal requirements.
• Customer notifications: Who will provide the necessary privacy information and when.
• Security and handover: How customer records will be transferred securely and who can access them.
• Warranties and indemnities: How risks relating to previous data protection issues, complaints or security breaches will be allocated.
• Retention and deletion: What records the seller may retain and what must be removed or returned after completion.

For example, a buyer might discover that the seller has experienced a data breach or that certain customer records were collected without appropriate privacy information. These issues may affect the contractual protections the buyer requires.

It's also important to remember that transferring customer data doesn't necessarily transfer the underlying customer contracts.

If the buyer intends to take over ongoing service agreements, the transaction may require an assignment or novation, depending on the contractual terms.

Where personal data will be transferred to an organisation outside the UK, the parties should also check whether the international transfer rules apply, including any requirements for appropriate safeguards.

Can the Buyer Use the Customer Database After the Sale?

Receiving customer information doesn't automatically give the buyer unrestricted permission to use it.

Under the UK GDPR, personal data must generally be collected for specified, explicit and legitimate purposes. Further use must comply with the purpose limitation rules.

For example, customer information transferred so a buyer can continue fulfilling existing orders may not automatically be used for an unrelated advertising campaign.

The buyer should consider whether its intended use is compatible with the original purpose or whether additional legal requirements must be satisfied.

Can the Buyer Use Customer Details for Marketing?

Marketing requires particular care where a business sale includes customer email addresses or contact lists.

Under the Privacy and Electronic Communications Regulations 2003 (PECR), marketing emails and texts sent to individual subscribers generally require consent unless an applicable exception applies.

One exception is the soft opt-in, which can allow businesses to market similar products or services to existing customers where specific conditions are met.

However, the soft opt-in generally requires the sender to have collected the contact details directly from the individual during a sale or negotiations for a sale, and to have provided the required opportunities to opt out.

A buyer cannot simply assume it inherits the seller's soft opt-in when purchasing a customer database.

For example, imagine purchasing an online retailer with 2,000 customer email addresses. You want to send promotional emails advertising your products.

Before doing so, you'll need to establish whether the existing permissions cover marketing from your organisation. Consent given specifically for the seller's marketing may not authorise messages from the buyer.

Different rules can apply to corporate subscribers, although UK GDPR obligations may still be relevant where personal data is involved.

The ICO's guidance on using marketing lists explains these considerations in more detail.

Acquiring customer data doesn't automatically mean acquiring permission to market to everyone on the list.

What Happens to Customer Records After Completion?

Once the sale is completed, both parties may still have data protection responsibilities.

For the buyer, this includes keeping customer information secure, ensuring records are accurate and respecting individuals' applicable data protection rights.

The buyer should also review its privacy documentation and establish appropriate retention arrangements.

For the seller, an important consideration is what happens to any customer information remaining in their possession.

If the database formed part of the sale, the seller shouldn't assume they can keep a copy or use that information for another business.

The sale agreement may require records to be deleted, access to customer systems to be removed and the handover to be confirmed.

However, some information may need to be retained for tax, accounting or other lawful purposes.

Under the UK GDPR's storage limitation principle, personal data generally shouldn't be kept in identifiable form for longer than necessary for the purposes for which it's processed.

Both parties should understand what information they can retain, why it's needed and what restrictions apply after completion.

Need Help With the Legal Side of Selling Your Business?

Customer information can be an important part of a business sale, but transferring it involves more than handing over a database.

It's important to understand your data protection obligations, establish whether a lawful basis exists and make sure the sale agreement properly addresses how customer information will be handled.

Sprintlaw's legal experts can assist with preparing or reviewing business sale agreements, privacy policies and related legal documents.

If you're preparing to sell or purchase a business, contact us at team@sprintlaw.co.uk or call 0808 134 7754 to discuss how we can help.