A business sale needs a plan for the customer database

Imagine a buyer asking for the customer database to understand the business it may acquire. The seller wants to keep the deal moving. Sending a full export can feel like an ordinary commercial step, but it exposes personal data before the parties have established what the buyer actually needs and which legal route supports the disclosure.

Separate diligence, approval, closing and integration. Each stage can involve a different purpose, recipient and degree of access. A transaction plan should make those differences visible.

Start with the question the buyer needs answered

If the buyer wants to understand repeat purchases, customer concentration or service volumes, aggregated information may answer the initial question. Where a sample is needed, consider whether it can be narrowed or reliably de-identified. Removing names alone does not necessarily remove identifiability.

A fuller disclosure may be justified at a later stage, but do not make it the default simply because the export is easy. Define the fields, recipients, access duration and restrictions before opening a data room or sending a file.

As of 22 October 2026, the relevant substantive DPDP provisions are scheduled for 13 May 2027 under the commencement notification. The future sections 4 to 7 and any relevant exemption need assessment against the actual transaction. Existing contractual and other applicable obligations also require attention during the transition.

Read the corporate-scheme provision precisely

Section 17(1)(e) addresses necessary processing for specified corporate schemes, including certain compromises, arrangements, mergers, reconstructions and transfers, approved by a court, tribunal or another legally competent authority. Its approval and necessity conditions are part of the provision.

Do not turn that wording into ‘every business sale is exempt’. An ordinary proposed sale, preliminary diligence or a particular asset transfer may require a different analysis. Transaction advisers should identify whether the exact scheme and processing fit the provision, and at which stage.

Even where section 17(1) applies, it preserves the section 8(1) accountability and section 8(5) security obligations. The exception is not permission to place an unrestricted customer export in an open folder. The future rule 6 safeguards remain relevant to the applicable security assessment.

A hypothetical services-business sale

A small maintenance business enters discussions with a potential buyer. At the first stage, the seller provides revenue and service-pattern summaries that answer the buyer’s commercial questions without identifying individual customers. A later question requires a limited sample, so the parties assess the necessary fields and controlled access arrangement.

Before closing, the advisers identify the actual transaction route and the customer records proposed for transfer. The handover includes current service obligations, relevant customer choices, corrections and restrictions. It does not simply send every historical working file because the folder belongs to the seller.

After closing, the buyer proposes marketing a different service to the acquired customer base. That use is assessed separately. The fact that the records arrived through a transaction does not automatically settle every future purpose for which the buyer wants to use them.

Control the diligence environment

Use access tied to named reviewers and the relevant stage. Restrict unnecessary downloads and keep a record of significant disclosures. Where reviewers need working copies, define their permitted location, use and treatment if the transaction ends without completion.

Check advisers and other participants as well as the buyer. A data room can expand quietly as additional teams are invited. Give somebody responsibility for approving access and removing it when the task ends.

If an issue is found, route it through the transaction process without circulating unnecessary personal detail. A buyer can understand a privacy weakness through a bounded description and evidence sample; it does not always need the full affected dataset.

Prepare the integration decision before closing

Identify which systems will receive transferred records, which old interfaces will be disabled and who owns unresolved retention or permission questions. Preserve relevant notice and consent evidence where applicable, rather than keeping only the customer contact fields.

Communications to customers should reflect the actual legal and service position. Do not invent a universal fresh-consent requirement for every sale, and do not assume no explanation or assessment is ever needed. The transaction structure and proposed processing matter.

The recurring failure is treating the database as an asset with no attached decisions. A controlled sale preserves the purposes, restrictions and evidence needed to use the records responsibly after ownership or operations change.