How do I stop a buyer from asking for too much too early?

If a buyer’s first list of requests runs ahead of what a decision needs, you can slow it by agreeing the order of disclosure in writing before anything sensitive moves, and by asking what each request is for. For documents that hold personal information about customers, employees or suppliers, federal privacy law gives you a reason to hold back, because it ties disclosure without consent to an agreement and to what the deal needs.

What federal privacy law says

PIPEDA s.7.2(1) covers organizations that are parties to a prospective business transaction, which the Act defines to include a purchase or sale of an organization or part of it. In addition to the other circumstances the Act sets out, it lets them use and disclose personal information without the individual’s knowledge or consent if two conditions are met. There must be an agreement requiring the recipient to use and disclose the information solely for purposes related to the transaction, to protect it by security safeguards appropriate to its sensitivity, and to return or destroy it within a reasonable time if the deal does not proceed. The information must also be necessary to decide whether to proceed and, if so, to complete the deal. Under s.7.2(4), none of this applies to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.

Provincial rules differ

Québec’s private-sector privacy Act, s.18.4, allows communication without consent to the other party when it is necessary to conclude a commercial transaction the enterprise intends to be a party to. An agreement must first be entered into in which, among other things, the other party undertakes to use the information only for concluding that transaction and to destroy it if the transaction is not concluded or the information is no longer necessary for concluding it. Alberta and British Columbia each have their own Personal Information Protection Act with business-transaction provisions, so confirm which law governs your records.

Staging the requests

Ask the buyer to say which decision each request supports. Share summary financials and anonymized schedules first, and hold back names, individual pay records and customer contracts until the confidentiality agreement is signed and you accept that the request is necessary to decide whether to proceed. Ask your lawyer whether that agreement contains the safeguard and return-or-destroy terms the statute describes. Later requests belong to the period described in what happens between the LOI and closing.