Selling a business and its database

The sale of most businesses will include its database, which is often a key asset in the form of customer lists, sale and purchase ledgers, inventories and know-how.

When considering the sale or purchase of a database, it is important to establish whether the data falls in the scope of the Data Protection Act 2018 (DPA) and, importantly, whether it is compliant.

Any shrewd buyer will seek reassurance by incorporating warranties into the sale agreement, which generally cover the following:

  • The database is fully compliant with the DPA
  • The seller is entitled to transfer the database to the buyer
  • The buyer is entitled to use the database under the DPA for the purposes that they intend to
  • The buyer has no notice of any claims or complaints by data subjects in relation to the database
  • The seller has received no notice that the Information Commissioner or any other regulatory authority considers the seller has, or may have, infringed any provision of the DPA

As always, any buyer should complete appropriate due diligence, asking to see copies of the information provided to data subjects, copies of agreements with third parties if those agreements are to continue, or copies of complaints and details of how they were handled.

The buyer has a duty to inform data subjects that their personal data is to be transferred to a new controller.

In the outright sale of a database as an asset, the transfer of personal data from one controller to another amounts to processing under the DPA. On completion, the buyer becomes a controller which means they have a duty to inform data subjects that their personal data is to be transferred to a new controller.

If the buyer is relying on the seller to send out such notice to the data subjects, it is advisable that this is detailed in the sale agreement.

If the sale of the database is part of a business sale by way of a share purchase, the controller remains the same.

Nevertheless, as part of due diligence, the buyer will want to be satisfied that data protection requirements have been met.

  • To read this feature in full and access further Lancashire business news, advice and analysis subscribe to Lancashire Business View magazine or join the LBV Hub from just £2.50 per month. Click here to subscribe now.