What cybersecurity and data privacy checks should I do before buying a business?

A cybersecurity and privacy review has two halves: what personal information the business holds and how well it has been protected, and how that information reaches you through the deal itself. Most small businesses hold customer, patient or employee records, so both halves matter even when the business looks low-tech.

How the seller may share data during the deal

Federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), lets the parties to a prospective business transaction use and disclose personal information without each individual’s consent, but only on conditions. They need an agreement requiring the receiver to use the information solely for purposes related to the deal, to protect it with safeguards suited to its sensitivity, and to return or destroy it within a reasonable time if the deal does not proceed. The information must also be necessary to decide whether to proceed. Expect to sign that agreement first, and ask only for what you need. The seller’s side is covered in Can I share customer data with a buyer?

What you can do with it after closing

Once the deal closes, the parties may keep using the information without fresh consent under the Act’s business-transaction rule if they have agreed to use it solely for the purposes it was collected for, with safeguards in place and any withdrawn consent honoured, the information is necessary for carrying on the business, and one of the parties notifies the individuals within a reasonable time. These exceptions do not apply to a deal whose primary purpose or result is buying or selling the personal information itself.

Breach records and vendors

Ask for the breach record. An organization must report to the Privacy Commissioner any breach of security safeguards that creates a real risk of significant harm, and must keep a record of every breach, reportable or not. Knowingly breaking those rules is an offence. The Commissioner’s guidance also says an organization stays responsible for personal information it passes to a third party for processing, so list the payment, cloud and payroll vendors that hold customer data and read their contracts.

Which privacy law applies

PIPEDA allows the federal government to exempt organizations in a province whose own privacy law is substantially similar, so some businesses answer to provincial legislation instead. The Privacy Commissioner’s website has a tool for working out which law applies, and it is worth running before you rely on a generic checklist.