Can I share customer data with a buyer?

Sellers face a real tension: a buyer cannot assess a business without understanding its customers, and the customers never agreed to have their information shown to a stranger. Privacy legislation resolves it with a narrow permission rather than a blanket one.

The exception is purpose-bound

The permission exists so the parties can determine whether to proceed and then carry out the transaction. It does not authorise using the information for anything else — a prospective buyer marketing to the seller’s customer list during diligence is outside it entirely, and so is retaining the data after walking away.

What the agreement has to do

The conditions attached to the exception are practical: use the information only for the transaction, protect it with security appropriate to its sensitivity, and return or destroy it if the deal does not complete. That is a contractual undertaking the confidentiality agreement should carry expressly, rather than something assumed from general confidentiality wording.

Stage what you disclose anyway

Having a legal basis is not a reason to disclose everything at once. Aggregated or anonymised information — revenue by segment, customer counts, contract lengths — answers most early questions without naming anyone. Identifiable customer and employee records belong in a later tier, released to a buyer who has signed a letter of intent and is genuinely proceeding.

After closing, the obligations continue

Where the transaction completes, the parties are generally required to notify affected individuals that their information has been transferred. The buyer then holds it subject to the purposes for which it was originally collected — buying a customer list does not create fresh consent to market to it in new ways.