Privacy Concerns in Asset Purchases

In an asset purchase, personal information is often one of the most valuable assets and one of the biggest sources of hidden risk. A buyer should find out what personal data the seller holds, what the seller promised about it, whether the data can lawfully be transferred and used for the buyer’s plans, and whether the seller has had security problems, and then address those risks in the purchase agreement and in post-closing integration.

Almost every business collects some personal information: customer names and emails, user accounts, payment details, employee records. Even modest data sets can trigger federal and state privacy and data security laws. Here is a practical framework for buyers, and the issues sellers should expect to answer.

Why Personal Data Matters in an Asset Deal

In an asset purchase, the buyer chooses which assets it acquires and which liabilities it assumes. Customer lists, user databases and marketing data are frequently on the asset schedule. But personal information is not an ordinary asset. Its use is limited by the promises the seller made when collecting it and by laws that may restrict how it is shared or repurposed.

Key legal frameworks include:

The FTC Act. The Federal Trade Commission treats a company’s failure to honor its privacy promises as a deceptive practice, and it has long taken the position that materially changing how previously collected data is used generally requires consumers’ affirmative consent. Those expectations can follow the data to a buyer.
California privacy law. The California Consumer Privacy Act, as amended by the CPRA, applies to covered businesses and includes employee and business-contact data. It generally does not treat a transfer of personal information to a buyer as part of a merger or acquisition as a “sale,” but if the buyer materially changes how it uses the data in a way inconsistent with the original notice, it must give prior notice of the new use. California also has data breach notification and reasonable security requirements. See our overview of California’s privacy laws.
Other state privacy laws. A growing number of states have comprehensive privacy laws with their own definitions, sensitive data rules and M&A provisions.
Sector-specific laws. Health information (HIPAA), financial information (GLBA), children’s data (COPPA), biometric data and payment card data each carry their own restrictions. Data about EU or UK residents may be subject to the GDPR or UK GDPR.
Bankruptcy sales. If the seller is in bankruptcy and its privacy policy restricts transfers, the Bankruptcy Code may require a consumer privacy ombudsman before personal data can be sold.

Step 1: Due Diligence

The buyer should ask for all privacy and data security documentation to be placed in the data room, and use diligence to answer these questions:

What data does the seller hold? Identify categories of personal information, whose data it is (customers, users, employees, contractors, minors), where it is stored, and whether any of it is sensitive personal information subject to stricter rules.
What did the seller promise? Review current and past privacy policies, terms of use, cookie banners and consent records. Check whether the policies disclose that data may be transferred in a sale of the business and whether the buyer’s intended uses fit within what was disclosed.
Does practice match the policy? Evaluate the seller’s actual practices: data inventories, vendor and processor contracts, retention schedules, security measures, employee training, and procedures for handling consumer requests to access, delete or opt out.
Has anything gone wrong? Ask about security incidents, breaches, ransomware events, regulator inquiries, consumer complaints and litigation, and how each was handled and whether required notifications were made.
Is the data needed? Decide whether the buyer actually needs each data set. Leaving behind data that is high-risk and low-value can be the simplest risk control.

Diligence itself involves privacy considerations. Sellers should generally provide policies, data maps and aggregated or redacted information first, and share actual personal information only when necessary, under a confidentiality agreement and with access limits.

Step 2: The Asset Purchase Agreement

Diligence findings should shape the contract. Buyers commonly negotiate:

Privacy and security representations that the seller has complied with applicable privacy laws and its own policies, has implemented reasonable security, has had no undisclosed breaches, and has the right to transfer the data to the buyer for the buyer’s intended use.
Excluded liabilities making clear that pre-closing privacy violations and breaches remain the seller’s responsibility.
Indemnification for third-party claims, regulatory penalties and breach response costs tied to pre-closing conduct, with survival periods, caps and baskets that reflect the actual risk. For a known issue, a specific indemnity or escrow may be more reliable than a general representation, especially because representation and warranty insurance often excludes known problems.
Covenants for the period between signing and closing, such as maintaining security, not changing privacy policies, and cooperating on any required notices or consents.
Data transfer mechanics covering how data will be moved securely, what the seller must delete after closing, and any transition services involving data.

Sellers should be careful not to give broad representations they cannot support, and should use disclosure schedules to describe known issues.

Step 3: Post-Closing Integration

After closing, the buyer becomes responsible for the data going forward. A practical integration plan includes:

Honoring the seller’s privacy commitments for previously collected data, or giving notice and obtaining consent where required before using it in materially different ways.
Carrying over consumer preferences, such as opt-outs and deletion requests, so they are not lost in migration.
Updating the buyer’s privacy policy and notices to reflect the newly acquired data and processing.
Bringing acquired systems up to the buyer’s security standards and reviewing vendor contracts.
Deleting data the buyer does not need, consistent with its retention schedule.

The Takeaway

Personal information can drive the value of an asset deal, but it comes with promises and legal limits attached. Buyers who diligence the data early, negotiate protections that match what they find, and plan the integration can reduce the chance that a privacy problem becomes their problem after closing.

Frequently Asked Questions

Can a seller transfer customer data in an asset sale?

Often yes, but it depends on what the seller promised in its privacy policy and on the laws that apply to the data. California’s privacy law generally treats a transfer of personal information as part of an acquisition as something other than a sale, but the buyer must use the data consistently with the notices consumers received or give notice before materially changing its use.

Does the buyer inherit the seller’s privacy liabilities in an asset purchase?

Not automatically. An asset buyer generally assumes only the liabilities it agrees to take. But a buyer that receives personal data takes on compliance obligations going forward, regulators may expect it to honor the seller’s privacy promises, and a poorly secured system can expose the buyer to new incidents. Representations, indemnities and diligence help manage that risk.

Usually not in full. Sellers can share summaries, data maps, policies and redacted or aggregated samples early, and provide personal information only when needed and under a confidentiality agreement with appropriate limits. Sharing more personal data than necessary before signing can create its own privacy risk.

How Sutter Law Can Help

We advise buyers and sellers on mergers and acquisitions, including privacy diligence, purchase agreement terms and post-closing compliance, and our privacy compliance practice can help with integration. Contact us for a free consultation.

This article is general information, not legal advice. Reading it does not create an attorney-client relationship.