Using an NDA Before Sharing Business Information With a Buyer in Ontario

Before a buyer will make an offer, they will want to see your financial statements, your customer and supplier lists, your contracts and details about your staff. That is the information that makes your business valuable, and it is also the information a competitor would most like to see.

A non-disclosure agreement (NDA), sometimes called a confidentiality agreement, is the usual first step. This article explains what an NDA for selling a business in Ontario should address, how privacy rules affect what you hand over, and what to think about if the buyer breaks the agreement.

Why sign an NDA before sharing anything

An NDA is a contract in which the buyer promises to keep what you disclose confidential and to use it only to decide whether to buy. Without one, you are relying on goodwill. A buyer who walks away could talk to your customers, hire your staff or use your pricing in a competing business, and you may have little to point to.

Timing matters. Sign the NDA before the buyer sees anything sensitive, including your name in some cases. Many sellers share information in stages: general information first, then more detail as the buyer becomes more serious.

Personal information needs extra care

Customer lists and employee records usually contain personal information. Federal privacy law (PIPEDA) allows organizations to use and disclose personal information without consent for a prospective business transaction, but only on conditions. The parties must have an agreement that the recipient will use it solely for purposes related to the transaction, protect it with appropriate safeguards, and return or destroy it within a reasonable time if the deal does not proceed.

The information must also be necessary to decide whether to proceed. That is a good reason to hold back things like individual employee files or full customer contact details until later stages, and to share summaries or anonymized data first.

There is an exception. The business-transaction exemption does not apply where the primary purpose or result of the deal is buying, selling or leasing personal information itself. If your business is essentially a database of people, get advice before sharing anything.

What an NDA should cover

No single template fits every sale, but most sellers' NDAs deal with the following points. The privacy-related terms reflect what PIPEDA expects where personal information is involved.

• A clear definition of confidential information, including financial records, customer and supplier lists, pricing, contracts, systems and employee details
• A promise to use the information solely for evaluating the transaction
• A promise to protect it with appropriate safeguards, such as limited access and secure file sharing
• An obligation to return or destroy the information within a reasonable time if the deal does not proceed
• A limit on who may see it, such as the buyer's advisers, lenders and named staff, who should be bound by the same terms
• A promise not to contact your customers, suppliers or employees about the sale without your permission
• A term for how long the confidentiality obligations last, since some information stays sensitive for years
• Which party's law and courts will apply, and what remedies are available if the NDA is broken

Whether a non-solicitation promise (not hiring your staff or approaching your customers) is enforceable depends on how it is written and on the facts. Have a lawyer review those clauses.

Enforcing an NDA and time limits

If a buyer misuses your information, the practical question is what you can do and how quickly. What remedies a court would give depends on the facts, the wording of the NDA and the harm shown, so this is where legal advice matters most.

Time limits also apply. Claims under a business agreement are generally subject to Ontario's Limitations Act, 2002, under which a proceeding cannot be started after the second anniversary of the day the claim was discovered, unless the Act provides otherwise. There is also an outer limit: no proceeding can be started after the 15th anniversary of the day the act or omission took place, regardless of discovery.

Parties to a business agreement, which is one where none of the parties is a consumer, may vary or exclude limitation periods if the agreement was made on or after October 19, 2006. That means an NDA or a later purchase agreement may set its own time frame, so read those terms carefully and do not assume the two-year rule applies.

After the NDA: what happens if the deal goes ahead

If the sale closes, the NDA usually gets replaced or supplemented by confidentiality terms in the purchase agreement. For personal information, PIPEDA allows the parties to keep using and disclosing it after closing if they agree to use it only for its original purposes, protect it and honour withdrawn consents. One of the parties must notify the individuals within a reasonable time that the transaction was completed and their information disclosed.

What to do next

• List what a buyer will want to see and decide which items can wait until later stages
• Mark which documents contain personal information about employees or customers
• Have an NDA prepared or reviewed before any sensitive document leaves your hands
• Keep a record of who received what and when
• Ask your lawyer how the NDA fits with the later purchase agreement, including any limitation period it sets
• Speak with a lawyer before you share anything if your business is built around personal data

Frequently asked questions