What should a confidentiality clause in a business sale LOI cover?

BDC describes a confidentiality agreement as one where a party undertakes not to use, disclose or permit the disclosure of confidential information sent during negotiations and due diligence, except to evaluate its participation in the deal. BDC says the LOI is very often preceded by one, and its counsel notes that an LOI can create binding obligations on confidentiality where it so provides. If the clause sits in your LOI, check that it is stated to be binding.

What counts as confidential

BDC’s examples of protected material include financial data, customer and supplier lists and intellectual property information shared in due diligence. Define the term around what you will actually release. Say whether the fact that talks are happening is itself confidential, and decide what is carved out, such as information already public.

Who may see it, and for what

Name who may receive the information, such as the buyer’s advisers and lenders, and ask whether the buyer will answer for anyone it tells. BDC’s counsel says the buyer agrees to use the information only to evaluate the proposed transaction, so write that limit in. Ask how long the duty lasts and what the clause says on breach. Our guide to keeping a sale confidential covers how the process itself protects you.

Personal information and return or destruction

If the information names employees or customers, privacy law may apply. PIPEDA s. 7.2(1), in addition to s. 7(2) and (3), lets parties to a prospective business transaction use and disclose personal information without the individual’s knowledge or consent if two things hold. They have an agreement requiring the recipient to use it solely for purposes related to the transaction, protect it with security safeguards appropriate to its sensitivity and, if the deal does not proceed, return or destroy it within a reasonable time. And the information is necessary to decide whether to proceed and, if so, to complete the deal. Under s. 7.2(4), this does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information. Alberta’s Personal Information Protection Act (s. 22) and British Columbia’s (s. 20) have their own business-transaction provisions, and so does Quebec’s private-sector privacy Act (s. 18.4), which requires the agreement first. Ask your lawyer which law covers your records.