Selling a data and analytics consulting firm in Canada

An owner who has decided to sell a data consultancy is selling something a buyer cannot inspect directly: client trust. The dashboards, pipelines and models are visible, but the reason clients let this firm run them on live data is not. That trust shows up in paperwork, so the order of preparation matters more than the marketing. Broadly, it runs like this: find out which client contracts can move, make the data-handling record match what those contracts promise, decide what a buyer may see before it signs, and plan how access and knowledge will pass to a new owner. This guide follows that order and describes what each step involves in Canadian law. Whether and when to sell remains the owner’s decision, with their own advisors.

Find out which client contracts can move

Start by reading every active client agreement for an assignment clause or a change-of-control clause. Ontario law-firm guidance on assigning and novating contracts explains that a seller can often assign a contract’s benefits without the other party’s involvement unless the contract requires consent, which it describes as extremely common in commercial contracts. It adds that an assignment does not by itself release the seller from its own obligations, while a novation needs the other party to agree. In an asset sale, contracts have to be moved to the buyer, so the review cannot be skipped; the asset sale and share sale guide sets out that choice. For a data firm, the platform-management agreements matter most, because they carry the recurring income.

Make the data-handling record match the contracts

A gap between practice and promise is a risk worth finding before a buyer does. Before listing, an owner can map where each client’s data physically sits: production environments, development sandboxes, laptops, and exports left over from finished projects. That map is then compared with what the contracts and the firm’s privacy statements say about location, retention, and return or destruction. PIPEDA says an organization remains responsible for personal information it transfers to a third party for processing and must use contractual or other means to secure comparable protection, which is why clients’ data terms matter and why leftover copies can be a liability rather than a convenience. Putting missing data-processing terms in place before a sale process begins avoids having to request them mid-deal.

Decide what a buyer may see before it signs

A data room is awkward for a data firm because the most revealing material is the client’s data, which the firm holds on someone else’s behalf. PIPEDA lets the parties to a prospective business transaction use and disclose personal information without the individual’s knowledge or consent if conditions are met, unless the transaction’s primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information. There must be an agreement requiring the recipient to use it solely for purposes related to the transaction, to protect it with safeguards appropriate to its sensitivity, and to return or destroy it within a reasonable time if the deal does not proceed. The information must also be necessary to decide whether to proceed and, if so, to complete the deal. That necessity test is a reason to ask whether raw client records are needed at all; a data room can instead show structure rather than content: schemas, architecture diagrams, anonymised samples and contract schedules. Client names are a separate confidentiality question, governed by the contracts and a non-disclosure agreement.

Quebec adds a second layer

If the firm holds data about Quebec residents, Quebec’s private-sector privacy law applies its own rules, which changed in 2022 and 2023. The Commission d’accès à l’information says that since September 2023 an organization must carry out a privacy impact assessment before communicating personal information outside Quebec, that the communication may go ahead if the assessment shows the information would be adequately protected, and that it must be covered by a written agreement meeting set terms. A person who operates a business is responsible for protecting the personal information it holds and acts as the person in charge of protecting it, a function it may delegate in writing, in whole or in part, and the title and contact details of the person in charge must be published. Quebec also has its own rule on disclosure in a commercial transaction, with its own conditions. Data that would reach a buyer or hosting provider outside Quebec is the kind of flow to have a Quebec lawyer review before it starts.

Plan the handover before buyers ask

The last piece is what actually passes on closing: the pipelines and models, their documentation, and the credentials and administrative rights that let someone run them. A written handover plan, covering who holds each cloud account, which client-owned environments the firm reaches only through delegated access, and how knowledge will move from senior staff to the buyer’s team, gives a buyer the answer to the handover question up front. Ownership paperwork belongs here too. Contractors who wrote code need signed assignments, because the Copyright Act makes an assignment valid only if it is in writing and signed by the owner of the right or the owner’s duly authorized agent, and moral rights, which cannot be assigned, can be waived. The Canadian Intellectual Property Office explains how an assignment is registered.

Items to settle early

These items can be checked in advance, before a buyer’s review reaches them:

• Client consents that arrive late because the requests went out late
• A data-processing term missing from a major client’s contract, found during the buyer’s review rather than the seller’s
• Contractor-written code with no signed assignment behind it
• Credentials and administrative rights held by one departing individual
• A privacy impact assessment or written agreement for Quebec data that nobody started