Can I stop a buyer from taking my customer list and walking away?

A list is hard to take back once someone has seen it, so most of your protection is arranged before disclosure. A signed agreement does not guarantee the buyer will behave. If a buyer misuses the list, the remedy is a dispute under that agreement, and a lawyer should tell you what it would take to enforce. What you can control now is what you share, when, and on what written terms.

Sign before you share

Ask for the agreement first. It should say the list is confidential, name who may see it, limit its use to evaluating the purchase, and bar contact with your customers, staff and suppliers without your consent. It should also say what the buyer does with the list if the deal fails. For individual customers, parts of this are not just good practice. Federal privacy law expects them.

What federal privacy law adds

Under PIPEDA, personal information means information about an identifiable individual. Section 7.2(1) is in addition to s. 7(2) and (3). It allows organizations that are parties to a prospective business transaction to use and disclose personal information without the individual’s knowledge or consent if two conditions are met. The first is an agreement requiring the organization that receives it to use and disclose it solely for purposes related to the transaction, protect it by security safeguards appropriate to its sensitivity, and, if the transaction does not proceed, return it to the organization that disclosed it or destroy it within a reasonable time. The second is that the information is necessary to decide whether to proceed and, if so, to complete the deal. Section 7.2(3) requires an organization to comply with the terms of that agreement. Under s. 7.2(4), these rules do not apply to a transaction whose primary purpose or result is the purchase, sale, other acquisition or disposition, or lease of personal information. Quebec’s private-sector privacy Act has its own rule for commercial transactions, worded differently.

Release the list in stages

The necessity condition is a useful guide. Early on, a buyer deciding whether to proceed may need totals and concentration rather than names. Hold identifying detail back until a letter of intent is signed, and share only the part that is needed. Ask your lawyer whether a list of business accounts, rather than individuals, falls under these rules at all.

If a copy goes missing

The Privacy Commissioner’s guidance says an organization must keep a record of every breach of security safeguards involving personal information under its control. It must also report to the Commissioner breaches that pose a real risk of significant harm to individuals.