What if a buyer forwards my business information to their investors?

A buyer who forwards your information to investors may have breached your confidentiality agreement, or may have acted within it. Which one is a question about the wording you signed, not about what feels fair. Read the agreement before you write to anyone, and keep a record of what you believe was shared and how you found out.

Start with who the agreement lets the buyer share with

Look for the clause that names who may receive confidential information. An agreement may allow disclosure to named advisers or financing sources, or only with your written consent. Check whether a permitted recipient must itself be bound to confidentiality, whether the buyer answers for what that recipient does with the information, and whether the agreement covers the fact that a sale is under way as well as the documents. An investor funding the purchase may fall inside the permitted group or outside it, and the words decide which.

Personal information carries a separate rule

Details about identifiable customers or employees are personal information, and privacy law adds to the contract, though PIPEDA s.4(1)(b) covers employee information only in connection with a federal work, undertaking or business. In addition to the circumstances in s.7(2) and (3), PIPEDA s.7.2(1) lets organizations that are parties to a prospective business transaction use and disclose personal information without the individual’s knowledge or consent if two conditions are met. The parties must have an agreement that requires the organization receiving the information to use and disclose it solely for purposes related to the transaction, to protect it with appropriate security safeguards and, if the transaction does not proceed, to return or destroy it within a reasonable time. And the information must be necessary to decide whether to proceed and, if so, to complete the deal. Section 7.2(3) requires the organization to comply with that agreement’s terms.

Quebec’s private-sector Act, s.18.4, has its own version: the agreement must be entered into first and must bar communication of the information without the person’s consent unless the Act allows it. Alberta and British Columbia run their own private-sector statutes with business-transaction provisions. Whether an investor counts as a party, or falls within the agreement, is a question for your lawyer.

What to do next

Ask the buyer in writing, through a lawyer if you can, what was shared, with whom, and whether each recipient is bound in writing. Ask that further sharing stop, and that anything the agreement does not cover be returned or destroyed. For the rest of the process, release only what each stage needs, as set out in what to share with a buyer and when, and hold the most sensitive records, such as customer names, until they are needed. A non-disclosure agreement can name exactly who may receive what.