Does an NDA cover a buyer’s whole team or just the buyer personally?

A non-disclosure agreement is a contract, so by default it binds the parties who sign it. If a buyer signs for a corporation, the corporation is bound. If an individual signs, the individual is bound. An accountant, a lender, a partner or an employee who sees your information is not a party unless the document brings that person in. The gap matters in a sale, because a buyer may need to show your information to advisers or a lender.

Who the agreement names

Read the definitions first. Look for who counts as the buyer’s “representatives” and what the buyer may share with them. Ask whether each person must be listed by name, or whether a class such as legal advisers or employees with a need to know is enough. Ask whether the buyer promises that those people will keep the information confidential, and whether the buyer answers to you if one of them does not. A person who signs a short joinder, agreeing to the same terms, is bound directly.

Customer and employee records

Personal information in your files adds a separate layer. Under PIPEDA s.7.2(1), organizations that are parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if two conditions are met. The first is an agreement that requires the organization receiving the information to use and disclose it solely for purposes related to the transaction, to protect it with appropriate security safeguards and, if the deal does not proceed, to return or destroy it within a reasonable time. The second is that the information is necessary to decide whether to proceed and, if so, to complete the deal. Under s.7.2(4), none of this applies to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information. Because that agreement binds the receiving organization, check that the NDA names the organization that will actually receive those records.

Quebec’s private-sector privacy Act, in s.18.4, has its own rule: an agreement must first be entered into with the other party, and among other things it must include an undertaking to destroy the information if the commercial transaction is not concluded or if using it is no longer necessary for concluding the transaction. The Office of the Privacy Commissioner of Canada says Alberta and British Columbia also have their own private-sector privacy laws, deemed substantially similar to PIPEDA.

Questions to settle before you sign

• Is the buyer signing personally, through a corporation, or both?
• Is there a defined list or class of people who may see your information?
• Does the buyer take responsibility if one of those people breaches?
• Must the information be returned or destroyed if the deal does not proceed?

BDC cautions that, depending on a listing site’s confidentiality procedures, word could get out to employees, customers or suppliers that you are selling. Decide who sees what at each stage. For the Deavo process, see what happens after you sign an NDA.