Can I require a buyer to destroy my documents if the deal falls apart?

Do not assume a buyer must hand back or destroy your documents. Put that duty in the agreement you sign before the buyer sees anything. Privacy law ties a return-or-destroy term to one kind of document, personal information about customers, employees or other people, and Quebec words its rule differently from the federal Act. For everything else in the data room, read what the agreement actually says.

What federal privacy law requires

Under s.7.2(1) of PIPEDA, in addition to the other consent-free routes in s.7(2) and (3), organizations that are parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if two conditions are met. First, they have an agreement requiring the organization that receives the information to use and disclose it solely for purposes related to the transaction, to protect it with safeguards suited to its sensitivity and, if the transaction does not proceed, to return it or destroy it within a reasonable time. Second, the information is necessary to decide whether to proceed and, if so, to complete the deal. Under s.7.2(4), this route does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.

How Quebec words it

Quebec’s private-sector privacy Act, in s.18.4, lets a person carrying on an enterprise communicate personal information, without the consent of the person concerned, to the other party to a commercial transaction it intends to be a party to, where that is necessary for concluding the transaction. An agreement must first be entered into, and it must stipulate, among other things, that the other party will destroy the information if the transaction is not concluded or if using it is no longer necessary to conclude it. The Act names destruction as the undertaking, not return.

Everything that is not personal information

Section 7.2 deals with personal information. For the rest of what you share, such as financial statements, supplier terms and lease copies, look to the confidentiality agreement you negotiate. Ask what the clause covers. Does it reach copies, notes, summaries and backups? Must the buyer confirm destruction in writing, and by what date? Can the buyer keep anything it must retain for its own legal reasons? If a clause says only “return all materials”, check whether it answers each of those. The confidentiality checklist lists what to settle before a data room opens.

If documents are lost or leaked

The Office of the Privacy Commissioner explains that organizations subject to PIPEDA must report to the Commissioner breaches of security safeguards involving personal information that pose a real risk of significant harm to individuals, and that the obligation rests with the organization in control of the information. If the buyer holds your customers’ or employees’ information, ask that the agreement require it to tell you promptly about any loss, so you can assess whether any obligation falls on you. For what else follows a collapsed deal, read what happens when a deal falls apart.