How do I prevent information leaks when selling my business?

No process removes the risk of a leak, because every person who learns of the sale is a possible source. What you control is how many people know, what each one can see, and what each one has promised. Those controls are contractual and procedural, so put them in place before the first buyer sees anything. This page covers the controls that operate while a sale is being prepared and discussed.

Sign before you share

BDC notes that, to pursue discussions with a seller, it is customary to sign a confidentiality agreement. It describes the agreement as one in which a party undertakes not to use, disclose or permit the disclosure of confidential information received during negotiations and due diligence, except to evaluate taking part in the transaction. BDC also notes that the information can come from documents and from discussions with the seller, directors, employees or representatives. Ask whether the wording reaches spoken information as well as documents, and whether it covers the buyer’s advisers and lenders.

Staff and customer personal information

Where federal privacy law applies, PIPEDA s.7.2(1) lets parties to a prospective business transaction use and disclose personal information without the individual’s knowledge or consent if two conditions are met, in addition to the routes in s.7(2) and (3). First, the parties have an agreement requiring the recipient to use and disclose the information solely for purposes related to the transaction, to protect it by security safeguards appropriate to its sensitivity, and, if the transaction does not proceed, to return or destroy it within a reasonable time. Second, the information is necessary to decide whether to proceed and, if so, to complete the transaction. Under s.7.2(4), this does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information. Provincial privacy laws may also apply, so check yours.

Release in stages and keep a record

Hold back the most sensitive material, such as names of staff and customers, until a buyer has shown serious interest. Record who received which document and when. BDC notes that a letter of intent can create binding obligations on confidentiality and exclusivity where it so provides, so check whether yours does. When a buyer withdraws, ask for written confirmation that the material has been returned or destroyed. A data room with access logs can help with the record, and keeping a sale confidential covers listing choices.