An online business may look straightforward on a financial statement: a website, recurring sales, a customer base and a set of operating accounts. I would also want to understand the information and permissions that keep those parts working. Access to a database does not answer whether the buyer can use its contents as intended or continue using the services around it.
Start with what the business depends on
I would start with an inventory of customer and supplier records, order histories, mailing lists, support tickets, analytics, domains and essential software accounts. For each item, the useful questions are who controls it, where it sits, what it is used for and which other service it depends on.
A mailing list, for example, deserves more attention than a subscriber count. How was it built? What were people told? Are consent records and unsubscribe preferences available? What does the buyer actually plan to send? Those questions help test the assumptions behind the proposed value of the list.
Deal structure matters too. Identify the entity holding the records today, the entity that will hold them after completion and any platform terms affected by the transaction. A purchase agreement should not assume that every account or permission follows the business automatically.
Plan diligence before exchanging personal information
A buyer needs enough information to evaluate the business, but a full customer export should not be the opening move. I would first ask whether summaries, redacted documents or a smaller staged disclosure can answer the question. Access should reflect the stage of the deal and the sensitivity of the information.
Where PIPEDA applies, its business-transaction provisions can permit certain uses and disclosures without individual consent, subject to conditions. For a prospective transaction, these include necessity and an agreement addressing transaction-only use, safeguards, and return or destruction if the deal fails. Further conditions apply after completion, including restrictions on use and notification. The exception does not apply where the transaction’s primary purpose or result is dealing in personal information. It is not a blanket permission to share customer records.
Check rights, dependencies and unresolved problems
I would connect the data inventory to the contracts and policies governing it. Review relevant customer terms, privacy notices, vendor agreements and the history of material changes. Confirm whether essential providers permit the proposed transfer or change of control, and whether new accounts or consents are needed.
Ask about known incidents, complaints, access requests and outstanding deletion commitments. Legal diligence can identify obligations, gaps and contractual responses. It cannot establish that systems are secure. Where the business depends heavily on technology or holds sensitive information, a suitably scoped technical assessment may be needed alongside the legal review.
Make handover part of the deal
The closing plan should identify who transfers accounts, verifies control, changes recovery details and removes access that is no longer appropriate. It should also address permitted copies, retention, customer communications and who deals with unfinished privacy requests. Credentials should move through an agreed secure process, rather than an ordinary diligence spreadsheet.
My starting point is simple: understand what the buyer needs to operate, what rights support that use and what has to happen before and after completion. Those answers can affect the scope of diligence, the purchase agreement and the transition budget. For a proposed acquisition, you can read more about my legal work through Falcon Law PC.