- A written confidentiality agreement is the normal first step before a buyer sees sensitive details about your business.
- Where employee or customer personal information is shared, federal privacy law expects an agreement with specific protections.
- Sharing information in stages limits the damage if a deal falls through.
If you are thinking of selling, you probably worry about employees leaving, customers hearing rumours and competitors using what they learn. A buyer cannot make a sensible offer without seeing real information, so you need a way to share it safely.
The usual tool is a non-disclosure agreement, often called an NDA or confidentiality agreement. This article explains what it does, what privacy law adds, and how to control the flow of information in an Ontario sale.
Why an NDA comes first
An NDA is a contract in which the buyer promises to keep what they learn private and to use it only to evaluate your business. Without one, you may have little to rely on if a prospective buyer shares your customer list or pricing with others.
It is worth signing before you hand over anything beyond basic, non-sensitive details. Many sellers start with a short summary that does not name the business, then require an NDA before sharing more.
What a good confidentiality agreement covers
- A clear definition of confidential information, including the fact that the business is for sale.
- A limit on use: the buyer may use the information only to evaluate the deal.
- Who may see it, such as named advisors and lenders who are also bound to confidentiality.
- A promise not to contact your employees, customers or suppliers without your permission.
- Return or destruction of documents if the deal does not proceed.
- How long the obligations last and what remedies apply if they are broken.
The exact wording depends on your business and the buyer. A lawyer can tailor it, especially if the buyer is a competitor.
Employee and customer information: what privacy law adds
Employee and customer records contain personal information. Under federal privacy law, organizations may use and disclose personal information for a prospective business transaction without consent, but the parties must have an agreement that the recipient will use it solely for purposes related to the transaction, protect it with appropriate safeguards, and return or destroy it within a reasonable time if the deal does not proceed. The information must also be necessary to decide whether to proceed.
In practice, this means your NDA should include these privacy terms, and you should share only what the buyer truly needs at each stage. Names and salaries of every employee are rarely needed early in the process.
After closing, the parties may keep using and disclosing the personal information without consent if they agree to use it only for its original purposes, protect it and honour withdrawn consents. One of the parties must notify the individuals within a reasonable time that the transaction was completed and their information disclosed. This exemption does not apply where the primary purpose or result of the transaction is buying, selling, acquiring, disposing of or leasing personal information.
Staging disclosure to protect your business
| Stage | What to share | Protection |
|---|---|---|
| Early interest | Anonymous summary of the business | No identifying details |
| After NDA | Financial overview and general operations | Signed confidentiality agreement |
| Serious offer | Contracts, employee and customer details as needed | NDA with privacy terms and a written offer |
| Before closing | Final verification | Confirmed deal terms and access controls |
Hold back the most sensitive material, such as customer names and key supplier terms, until the buyer is serious. If your buyer is a competitor, consider having an outside advisor review the most sensitive records instead of handing them over.
Talking to employees and what to do next
Many owners worry about when to tell staff. There is no one right answer, but it helps to know that if a buyer employs your employee after a sale, the sale does not end the employment, the buyer is treated as the employer, and the employee's service flows through for entitlements such as vacation and notice of termination. Prior service does not carry over if the buyer hires the employee more than 13 weeks after the earlier of the employee's last day with the seller or the day of the sale.
- Have a lawyer prepare or review the NDA before any buyer sees sensitive material.
- Decide in advance who in your business will know about the sale.
- Prepare a plan for telling employees and key customers at the right time.
- Keep a log of who received which documents.
- Make sure advisors you use are also bound to confidentiality.
Frequently asked questions
Is an NDA legally required before I share information with a buyer?
A non-disclosure agreement (NDA) is not required for every sale, and how this applies depends on your situation, so it is worth confirming with a lawyer. However, where personal information is shared for a prospective transaction without consent, privacy law requires an agreement with specific protections. In any event, an NDA is the standard way to protect your business.
Can I share employee records during due diligence?
Yes, within limits. The information must be necessary to decide whether to proceed, and the recipient must agree to use it only for the transaction, protect it and return or destroy it if the deal fails.
What happens to personal information after the sale closes?
The parties may continue to use and disclose it if they agree to use it only for its original purposes, protect it and honour withdrawn consents. One party must notify the individuals within a reasonable time.
Does the privacy exemption apply to every deal?
No. It does not apply where the primary purpose or result of the transaction is buying, selling, acquiring, disposing of or leasing personal information. A lawyer can tell you whether your deal is affected.
Sources
- Ontario – Your guide to the Employment Standards Act: Continuity of employment — ontario.ca
- Personal Information Protection and Electronic Documents Act, s. 7.2(1) — Justice Laws (federal)
Links go to official government, court and regulator pages. The law changes — confirm you are reading the current version.
This is a business purchase or sale question
Start a file online — flat, published fees, reviewed by a licensed lawyer before a dollar is owed.