PIPEDA section 7.2: sharing personal information in a deal data room

Every sale of a Canadian business involves personal information. The buyer wants to know who works there, what they earn, which customers pay the bills and whether any claims are open. Getting consent from each employee and customer before a confidential sale is not realistic. The PIPEDA business transaction exception solves that problem, with conditions.

This guide sets out the conditions in plain words, compares them with the provincial laws, and shows how to set up a data room so you can prove you met them. It is general information, not legal advice; your deal counsel should confirm how the rules apply to your facts.

What section 7.2 says

The Personal Information Protection and Electronic Documents Act (PIPEDA) gained section 7.2 through the Digital Privacy Act in 2015. You can read the text on the federal Justice Laws website (laws-lois.justice.gc.ca, statute P-8.6). It has four parts.

Section 7.2(1), before closing. Organizations that are parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if both of these are true:

• (a) the parties have entered into an agreement that requires the organization receiving the information to use and disclose it solely for purposes related to the transaction, to protect it with security safeguards appropriate to its sensitivity, and, if the transaction does not proceed, to return or destroy it within a reasonable time; and
• (b) the information is necessary to determine whether to proceed with the transaction and, if the decision is to proceed, to complete it.

Section 7.2(2), after closing. If the transaction is completed, the parties may keep using and disclosing the information if they have agreed to use it only for the purposes for which it was originally collected, to protect it, and to give effect to any withdrawal of consent; if it is necessary to carry on the business that was the object of the transaction; and if one of the parties notifies the individuals, within a reasonable time after completion, that the transaction is complete and their information has been disclosed.

Section 7.2(3) says each organization must comply with the agreement it signed.

Section 7.2(4) excludes deals whose primary purpose or result is buying, selling, acquiring, disposing of or leasing personal information. Selling a customer list on its own is not a business transaction under this exception.

“Business transaction” is defined in section 2(1) of PIPEDA. It covers the purchase, sale or other acquisition or disposition of an organization or part of it, mergers and amalgamations, loans and other financing, the creation of a security interest, leases and licences of an organization’s assets, and certain other arrangements.

What personal information sits in a deal room

Most of a data room is about the company, not people. But several folders are full of personal information:

One nuance trips up many sellers. PIPEDA only covers employee information of federal works, undertakings or businesses, such as banks, airlines, railways and telecom carriers. For a provincially regulated employer, employee data falls under Alberta’s or BC’s PIPA, Quebec’s act, or in other provinces often no private-sector privacy statute at all. Customer data is a different matter: PIPEDA applies to it in commercial activity outside the three provinces with their own laws. Our HR and employee records use case shows a folder structure built around these limits.

Quebec: sections 18.4 and 17

Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, has its own business transaction rule in section 18.4. A business may communicate personal information without consent to the other party if it is necessary to conclude a commercial transaction. Before any exchange, the parties sign an agreement in which the receiving party undertakes to use the information only to conclude the transaction, not to communicate it without consent unless the Act allows, to protect its confidentiality, and to destroy it if the transaction does not go ahead or the information is no longer needed. If the deal closes and the buyer keeps using the information, it must tell the individuals within a reasonable time.

Section 17 is the second layer. Before personal information is communicated outside Quebec, the business must carry out a privacy impact assessment (PIA) that weighs the sensitivity of the information, the purpose, the protection measures (including contractual ones) and the legal regime of the place where it will go. That includes a data room hosted in Ontario, the US or Europe, and it includes a bidder in Toronto downloading files. The duty has been in force since September 22, 2023. Penal fines under the act reach C$25 million or 4% of worldwide turnover. More on the Quebec province page.

Alberta and British Columbia

Both western provinces have a Personal Information Protection Act that applies to private-sector organizations within the province, including employee information.

Alberta PIPA, section 22, lets parties to a business transaction collect, use and disclose personal information without consent before and at completion, if their agreement restricts it to purposes related to the transaction and it is necessary to decide whether to proceed and to carry it out. It does not apply when the main purpose of the deal is trading in personal information. See the Alberta page.

BC PIPA, section 20, is narrower. It covers personal information about employees, customers, directors, officers and shareholders. A prospective party may receive it if it is necessary to decide whether to proceed and an agreement limits use to purposes related to the proposed transaction. After the deal proceeds, the information must relate only to the part of the business that changed hands, be used only for its original purposes, and the individuals must be notified. If the deal fails, the prospective party destroys or returns the information. See the British Columbia page.

Health statutes

Health information has its own laws. Ontario’s Personal Health Information Protection Act (PHIPA), section 42, lets a health information custodian disclose personal health information to a potential successor so it can assess the operations, if the successor first agrees in writing to keep it confidential and secure and not to keep it longer than needed. Alberta’s Health Information Act and similar statutes in other provinces have their own rules. In practice, a buyer of a clinic, pharmacy or home care business looks at aggregate figures first and samples records only late, under supervision.

The regimes side by side

Who sees employee data, and when

Staged disclosure is the main tool for meeting the necessity test. Early bidders see summaries; only the preferred buyer sees named data; SINs and banking details almost never leave the seller.

Redaction and clean teams

Redaction removes what the buyer does not need. Use initials or employee numbers instead of names, remove SINs entirely, group salaries into bands, and black out health details in accommodation files. Redact a copy; keep the original outside the room.

A clean team is a small group on the buyer’s side, often outside counsel and consultants, who see competitively sensitive or personal information and report only conclusions to the business team. Clean teams were built for competition law, but they help on privacy too: fewer people see the data, and the agreement can name them. The glossary defines clean team and staged disclosure.

What the purchase agreement and NDA should say

The NDA usually carries the section 7.2 terms for the diligence period; the purchase agreement covers closing and after. Between them, make sure you have:

• a clause limiting use of personal information to evaluating and completing the transaction;
• security safeguards proportionate to sensitivity, including the data room’s controls;
• return or destruction within a set number of days if the deal ends, with a written certificate;
• for Quebec data, the specific undertakings in s. 18.4 and a reference to the s. 17 PIA;
• post-closing: use only for the original purposes, respect for withdrawals of consent, and who sends the notice to individuals;
• breach notice between the parties fast enough to meet regulatory deadlines;
• a representation from the seller that personal information was collected lawfully.

Our sell-side due diligence use case shows where these documents sit in the room.

Breach reporting

Under PIPEDA section 10.1, an organization must report to the Office of the Privacy Commissioner any breach of security safeguards involving personal information under its control if it is reasonable to believe the breach creates a real risk of significant harm to an individual. It must also notify affected individuals and, where it could reduce the harm, other organizations. These duties have applied since November 1, 2018. Section 10.3 requires a record of every breach, reportable or not, and the Breach of Security Safeguards Regulations require keeping each record for 24 months. Knowingly failing to report or keep records can lead to fines of up to C$100,000.

Quebec calls it a confidentiality incident: if there is a risk of serious injury, the business notifies the Commission d’accès à l’information and the individuals, and keeps an incident register. Alberta PIPA also requires notice to its commissioner where there is a real risk of significant harm.

A misdirected invitation, a bidder’s account shared with a colleague, or a payroll file uploaded to the wrong folder can all count. The activity log tells you quickly who opened the file, which is the first thing the regulator will ask.

Data room settings that help

No setting replaces the agreement, but the right controls make the safeguards real and give you evidence. Here is how many of the 18 data rooms we track list each control:

Hosting location matters for Quebec’s s. 17 assessment and for cross-border bidders; our cross-border deals use case covers that side. The rating method explains how these controls feed our privacy and access-control scores, and the best virtual data rooms in Canada page lists which vendor offers what.