Buying an IT support & break-fix shop in Canada

A break-fix shop may change hands with little that can be inspected: a phone number, a client list, a bench, some parts stock and a reputation. Central questions are whether the reputation is attached to the shop or to the seller, and whether you are the right person to carry it. This guide is written for someone evaluating an opportunity, before any offer is made. It covers what a sturdier shop looks like against a more fragile one, what a seller may not raise, what you take on personally as the new keeper of client information, and who else may be looking at the same shop. It does not tell you whether to buy. It sets out what to weigh.

What a sturdier shop looks like at the counter

A sturdier shop shows clients who call repeatedly without the owner’s involvement, more than one technician whom clients recognise, and a ticket history that is steady rather than driven by one crisis or one refresh project. Its client environments are written down, and part of its work may already sit on monthly plans, which suggests clients accept recurring billing. A more fragile one has revenue that tracks the owner’s own hours, clients who reach the owner on a personal mobile, and little on paper. The client mix matters as well. Households that call once for a repair and small offices that treat the shop as their IT department are different bases, so it is worth asking the seller to split revenue between them; a seller who cannot may not yet have looked closely at what is being sold.

What the seller may not volunteer

A seller can be too close to the business to see some of these things. Ask which clients stay because of a personal favour, such as a discount or a promise to answer at any hour, that will not survive a change of owner. Ask which jobs were done on informal terms with no written scope. Ask about any incident in which client data was lost, exposed or accessed without permission. PIPEDA requires an organization to keep a record of every breach of security safeguards involving personal information under its control, and the Office of the Privacy Commissioner says those records must be kept for two years and that it can ask to see them. A shop that holds such a record can show it. A shop that holds none may have had no breaches, or may never have looked for them, and the follow-up question is how it would have found out.

Whose record is it when a client’s data is involved

The record-keeping duty rests on the organization in control of the information. For data in the shop’s own systems and on devices it holds, that is the shop. For personal information a client has handed to an outside provider for processing, the Commissioner’s guidance treats the client as keeping control and responsibility for breach reporting. The guidance adds that control is assessed case by case, and that a processor which uses or discloses the same information for other purposes is acting as an organization in control of it. Whether routine repair access fits either description depends on what the shop actually touches, which is a question for the client’s advisor. For a buyer, it is worth asking how the shop has told clients in the past when something went wrong with their data.

What you take on as the new keeper of client information

After closing, the organization that holds the shop’s client information, which may be you or a company you own, is responsible for it. PIPEDA’s accountability principle makes an organization responsible for personal information in its possession or custody, including information transferred to a third party for processing, and it expects the organization to use contractual or other means to provide a comparable level of protection while a third party processes it. After a completed transaction, the Act lets the parties use and disclose the information without the individual’s knowledge or consent if conditions are met, among them an agreement requiring each party to use and disclose it solely for the purposes for which it was collected, permitted to be used or disclosed before the transaction was completed, that it is necessary for carrying on the business that was the object of the transaction, and that one of the parties notifies the individual within a reasonable time after completion, so a client list is not an open licence to market anything to anyone.

Quebec can add duties

If the shop carries on business in Quebec or serves clients there, whether Quebec’s private-sector privacy law applies is a question for a lawyer, and the Commission d’accès à l’information describes the obligations that its Law 25 reforms bring. Anyone who operates a business is responsible for protecting the personal information it holds. The person with the highest authority performs the role of person in charge of that protection and may delegate it in writing, in whole or in part, to anyone, and the title and contact details of that person must be published on the business’s website or, if it has none, made accessible by another appropriate means. Incidents that present a risk of serious injury must be reported to the Commission and to the people concerned, and a register of confidentiality incidents must be kept and given to the Commission on request. The Commission can also impose administrative monetary penalties on businesses that contravene the private-sector Act.

The technicians are part of what you are buying

Technical capacity sits in people, so ask who the technicians are, how long they have been there, how they are paid and whether they intend to stay. The CRA says an employee generally works under the direction and control of the business under a contract of service, that a self-employed worker is not under the payer’s direction or control, and that all the facts, including the actual terms and conditions, decide a worker’s status, not just the intention. A bench of contractors who in practice work like employees raises a classification question. A bench of truly independent contractors raises a retention question, because nothing ties them to the new owner.

Who else is looking, and what each is buying

If another bidder is a local managed-service provider with a plan to convert transactional clients to monthly contracts, it would read the client list for the accounts that fit that move. If you want an owner-operated service business, you are buying a job as well as a business, so check whether the earnings, after paying someone to do the owner’s technical work, still make sense. Buyers with different plans can read the same shop differently, so offers on a single shop can diverge.

Questions worth putting to the seller before an offer

These come straight from the points above and are meant as prompts, not a checklist for any particular deal.

• What share of last year’s revenue came from clients who called more than once, and which technician handled those calls?
• Which accounts, credentials and licences are held in the owner’s personal name rather than the company’s?
• Has any client information been lost, exposed or accessed without permission, and where is the record?
• Will the seller stay on for a handover, and sign a non-solicitation promise as well as a non-compete?
• How are the technicians engaged, and which of them has said they will stay?