What information should a vendor release first?

Nothing in the sources cited here sets a fixed order for what a seller releases in a Canadian sale. What the law does regulate is personal information about employees, customers and other individuals. That affects what goes into the first package a buyer sees.

What buyers ask to see

BDC says buyers want to understand financial performance, and that they will ask to look at historic and interim financial statements, projections, tax returns and other records. BDC also says a lawyer familiar with business transitions supplies information during due diligence. Ask your lawyer whether summaries and statements that do not name individuals can go first, with more detail later.

Personal information has conditions

Section 7.2(1) of PIPEDA applies in addition to the consent-free routes in section 7. It lets organizations that are parties to a prospective business transaction use and disclose personal information without the individual’s knowledge or consent if two things are true. First, they have an agreement requiring the recipient to use and disclose it solely for purposes related to the transaction, to protect it by security safeguards appropriate to its sensitivity, and to return or destroy it within a reasonable time if the transaction does not proceed. Second, the information is necessary to decide whether to proceed and, if so, to complete the deal. Under section 7.2(4), this does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.

After closing

If the transaction is completed, section 7.2(2) allows continued use and disclosure of that information on further conditions. Those include an agreement binding each party, the information being necessary to carry on the business that was acquired, and a notice to the individuals, from one of the parties, within a reasonable time after completion. The Privacy Commissioner’s PIPEDA page lists the principles the Act builds on, including consent, limiting use, disclosure and retention, and safeguards.

• Ask whether a first-round package can be built without names, such as role-based staff data and grouped customer figures.
• Sign an agreement with the terms section 7.2(1)(a) requires before sharing anything that identifies a person.
• Ask your lawyer whether each document is necessary at this stage, as section 7.2(1) requires.

For protecting the sale itself, see how to keep a business sale confidential.