What happens to customer data and privacy obligations when a tech company changes hands?

Customer data doesn't just transfer as a generic asset; the privacy obligations attached to it transfer along with it, and in some cases those obligations actually shape whether the transfer is even permitted. Most privacy laws applicable to Ontario businesses require that personal information be used only for purposes a customer would reasonably expect, or has consented to, which means a company's own privacy policy at the time the data was collected matters a great deal to what a buyer can do with that data afterward.

In a share sale, the corporation holding the data doesn't change, so the existing privacy obligations and commitments generally continue as-is. In an asset sale, the transfer of a customer database is itself a use of personal information that needs to fit within what customers were told when they provided it, and buyers sometimes need to give customers fresh notice, or in some cases seek consent, depending on how the original privacy policy was worded and what the buyer intends to do with the data going forward.

Reviewing the seller's actual privacy policy and past practices, not just assuming "the data comes with the deal," is essential due diligence before a data-driven business changes hands.