Should I get an NDA signed before sharing financials with a buyer?

Financial statements, payroll summaries and customer lists show how a business really performs. Once they are in a buyer’s hands, you cannot take the knowledge back. A signed confidentiality agreement sets the terms before that happens, and for any personal information in the package, federal privacy law points the same way.

What PIPEDA says about sharing in a deal

PIPEDA, the federal private-sector privacy Act, includes a rule for prospective business transactions. Under section 7.2(1), in addition to the circumstances in sections 7(2) and (3), organizations that are parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if two conditions are met. The Act defines a business transaction to include the purchase or sale of an organization or part of it, a merger, a financing and a lease of assets.

What the agreement must contain

The first condition is an agreement that requires the organization receiving the personal information to use and disclose it solely for purposes related to the transaction, and to protect it with security safeguards appropriate to its sensitivity. If the transaction does not proceed, the agreement must also require the recipient to return the information or destroy it within a reasonable time. The second condition is that the information is necessary to decide whether to proceed and, if so, to complete the deal.

• A recipient who signs such an agreement must then comply with its terms (s. 7.2(3)).
• The rule does not apply where the primary purpose or result of the transaction is buying or selling personal information (s. 7.2(4)).
• Share only what is necessary at each stage; the necessity condition is part of the rule.

Which privacy law applies to you

The Office of the Privacy Commissioner explains that PIPEDA covers private-sector organizations handling personal information in commercial activities. It also notes that Alberta, British Columbia and Quebec have their own private-sector laws deemed substantially similar, and that organizations under those laws are generally exempt from PIPEDA for the collection, use or disclosure of personal information within that province, while personal information that crosses provincial or national borders in commercial activities remains subject to PIPEDA. Ask your lawyer which regime governs your business and what its business-transaction provisions require.

An agreement also needs to cover what the buyer may do with your commercial information. For what follows signing, see what happens after I sign an NDA, and for deciding who gets the information at all, see how to qualify a buyer.