What happens if I buy a small business including a customer database?

View printable version of this page

Question: What happens if I buy a small business including a customer database?

Answer: If you buy the assets of a business which include personal information, such as a customer database, you are trading in personal information and your business will have to comply with the Privacy Act unless:

• you have the consent of the individuals concerned before the sale is completed; or
• the purchase is required or authorised by law.

The purchase of a business is not trading in personal information and the business will not have to comply with the Privacy Act if it only involves a change of ownership, or sale of shares, of the business and the personal information is still held by the same business. In this case, the business may have new owners, but the business has not disclosed the personal information.

For more information on whether or not your small business is exempt from the Privacy Act see the Privacy Checklist for Small Business 2002 and Information Sheet 16-2002: Application of key NPPs to due diligence and completion when buying and selling a business.