Selling customer list in business sale

This is a common and important question in business sales. The short answer is yes, a customer list can be sold as part of a business sale, but there are several legal considerations that need careful attention.

General position:

A customer list is typically treated as a business asset, often categorised as goodwill or as a separate intangible asset. It can be transferred as part of an asset sale or will pass with the business in a share sale. There is nothing inherently unlawful about including it in a sale, but the way you handle the data within that list is where the legal complexity lies.

Data protection:

This is the most significant area of risk. Customer lists will almost certainly contain personal data, which means the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply. The key issues are as follows.

1. Lawful basis for processing. Transferring personal data to a buyer is a form of processing. You need a lawful basis under Article 6 of the UK GDPR. Legitimate interests is often relied upon, but this requires a balancing exercise between your interests and the rights of the individuals whose data is being transferred.

2. Privacy notices. If your existing privacy notice does not mention the possibility of transferring data as part of a business sale or restructuring, you may have a problem. Many well-drafted privacy notices include this as a standard provision, so check yours carefully.

3. Transparency. Data subjects generally need to be informed about any change in who controls their data. In practice, the buyer will usually need to notify customers after completion that it has acquired the business and now holds their data, explaining the lawful basis and their rights.

4. Data minimisation. You should only transfer data that is necessary and relevant. Transferring vast quantities of data that serve no purpose for the buyer would be harder to justify.

5. Due diligence stage. Be cautious about sharing personal data during pre-sale due diligence. Anonymised or aggregated data is safer at that stage. If identifiable data must be shared, use confidentiality agreements (NDAs) and limit access.

Contractual considerations:

Check whether any contracts with your customers contain restrictions on sharing their data or assigning the relationship. Some terms of business include clauses that limit what you can do with customer information, or require consent before assignment. If you are in a regulated sector, additional rules may apply.

Confidential information:

A customer list may also qualify as confidential information or even a trade secret. This is actually helpful to you as a seller because it gives the list commercial value, but it also means you should ensure the sale agreement contains appropriate protections so that, for example, if the sale falls through, the prospective buyer cannot use the information.

Restrictive covenants:

If you are selling and will remain active in the same industry, the buyer will almost certainly want non-compete and non-solicitation covenants from you to protect the value of the customer list they are purchasing. These are enforceable if they are reasonable in scope, duration, and geographical area.

Warranties and indemnities:

The buyer will likely ask you to warrant that the customer list is accurate, that you have complied with data protection law in compiling and maintaining it, and that you have the right to transfer it. Be careful about what you warrant, particularly if your data protection housekeeping has not been immaculate.

Practical next steps:

1. Review your privacy notice to check whether it covers data transfers in the context of a business sale.

2. Audit your customer list to ensure it is accurate, up to date, and that you can demonstrate a lawful basis for holding and transferring the data.

3. Check your customer contracts for any restrictions on assignment or data sharing.

4. During due diligence, share anonymised data where possible and use robust NDAs.

5. Ensure the sale agreement addresses data protection compliance, including who will notify customers post-completion and any transitional data sharing arrangements.

6. Consider whether the ICO's published guidance on data sharing and mergers and acquisitions is relevant to your specific situation.

The value of a customer list can be significant, so getting this right protects both the sale price and your exposure to post-sale claims.