PDPA When Selling a Business: Can You Share Staff and Customer Data?

Short answer: yes, in most business sales you can share staff and customer data with a serious buyer without asking each person first. Singapore’s Personal Data Protection Act (PDPA) has a business asset transaction exception for this. But it comes with conditions: share only what the buyer needs to decide, sign an agreement limiting its use to the deal, get the data back or destroyed if the deal fails, and tell the people affected once the sale completes.

This guide is general information drawn from the PDPA on Singapore Statutes Online and guidance from the Personal Data Protection Commission (PDPC), not legal advice. Ask a Singapore lawyer to check your sale documents and data room before you share anything.

Does the PDPA let a seller share staff and customer data with a buyer?

Normally an organisation needs consent before it discloses someone’s personal data. Section 17 of the PDPA allows collection, use and disclosure without consent in the situations set out in its schedules, and Part 4 of the First Schedule covers business asset transactions.

A business asset transaction includes the purchase, sale, lease, merger, amalgamation or any other acquisition, disposal or financing of:

• an organisation, or a portion of it;
• an interest in an organisation, such as shares in a company; or
• any of the business or assets of an organisation.

The data covered is about the seller’s “applicable individuals”. The Act defines these to include contractors, customers, directors, employees, officers and shareholders. So staff records and customer lists are both in scope.

The PDPA’s definition of “organisation” includes individuals and unincorporated bodies, so the exception can apply to a sole proprietor or partnership selling a business, not only a Pte Ltd.

What conditions apply while the buyer is still deciding?

Before the deal is signed, the buyer is a “prospective party”. The Act then sets two conditions:

• Only what is necessary: the seller may disclose, and the buyer may collect, only personal data that is necessary for the buyer to decide whether to go ahead.
• A purpose-limiting agreement: the buyer and seller must have an agreement that requires the buyer to use or disclose the data only for purposes related to the transaction.

If only part of the business is being sold, such as one outlet or one product line, the data must relate directly to that part. And if the deal does not proceed or is not completed, the buyer must destroy or return all the personal data it collected.

The PDPC’s Advisory Guidelines on Key Concepts add a reminder that these exceptions do not override other legal duties, such as duties to protect confidential information or contractual obligations. Your confidentiality agreement still matters. Our guide to the documents to sign before the sale agreement covers the NDA and letter of intent stage.

What changes after the deal completes?

Once the buyer enters into the transaction, three more conditions apply:

• The buyer may use or disclose the data only for the same purposes the seller was allowed to use it for.
• Any data that does not relate directly to the part of the business bought must be destroyed or returned to the seller.
• The buyer or the seller must notify the individuals whose data was disclosed that the transaction has taken place and that their data has been disclosed to the buyer.

The Act says either party can give the notice, so agree in the sale agreement who sends it and when. If staff are moving across, our guide to taking over staff in a business sale covers the employment side of the handover.

Does it matter if it is a share sale or an asset sale?

Both are covered. An asset sale is a sale of business or assets. A share sale is a sale of an interest in an organisation. Paragraph 2 of Part 4 deals with a sale of shares in a company and sets the same pattern of conditions: only necessary data before signing, an agreement limiting use, return or destruction if the deal fails, and notice to the individuals afterwards.

The practical difference is who holds the data after completion. In an asset sale, the data moves to the buyer’s business. In a share sale, it stays with the same company, which now has a new owner. See asset sale vs share sale and how a share purchase works for the wider trade-offs.

What should a seller put in the data room, and what should stay out?

“Necessary to decide” is narrower than most sellers assume. PDPC’s framework for collecting, using and disclosing personal data asks organisations to consider whether anonymised or aggregated data can achieve the purpose before using personal data. A staged approach works well:

• Early stage: headcount, roles, salary bands, length of service, customer numbers, revenue by segment and top customers coded as Customer A, B and C.
• Later stage, with the agreement signed: named key staff, employment contracts and named major customers, if the buyer genuinely needs them to decide.
• Usually leave out: NRIC numbers, home addresses, medical details and full customer databases. Mask or remove fields the buyer does not need.

Section 24 of the PDPA also requires an organisation to make reasonable security arrangements for personal data in its possession or control. In practice, that means a data room with access control rather than spreadsheets passed around by email or chat.

Business contact information, such as a client contact’s name, job title, office phone and work email, is mostly outside the PDPA’s consent and care rules when it was not given solely for personal purposes. It can still be commercially sensitive, so protect it under your NDA. Our guides on keeping a sale confidential and on the due diligence buyers need show how to stage what you reveal.

Can a buyer use the customer list for marketing after the takeover?

Only within the purposes the seller was allowed to use it for. If customers agreed to receive the seller’s promotions, the buyer can generally carry on within that scope. If the seller never had consent for marketing, buying the business does not create it. A new purpose needs consent or another basis under the PDPA, and the Do Not Call rules in Part 9 of the Act still apply to marketing calls and texts sent to Singapore phone numbers.

What if the buyer is overseas, or only wants the customer list?

Section 26 says an organisation must not transfer personal data outside Singapore except in line with prescribed requirements that keep the protection comparable to the PDPA. If a foreign buyer’s team will review files from abroad, raise this with your lawyer early. Our guide for foreigners buying a Singapore business covers the other steps.

A sale of only a customer list is different. The Act’s definition of a business asset transaction excludes the personal data being disclosed from the “business or assets” being sold. A deal where the list itself is the only thing changing hands is therefore unlikely to fit this exception. Take advice before selling a database on its own.

Where can you buy or sell a business with customer data on SG Business Mart?

Many listings include data as part of the value. An e-commerce brand for mothers lists a customer email database, a B2B SaaS platform includes its customer database, and a Woodlands tuition agency cites a network of around 170 tutor contacts. These are seller claims. Ask how the data was collected and what people were told, because the buyer can only use it for those purposes.

SG Business Mart is a Singapore marketplace, not a broker. Sellers pay a one-time fee for a listing package (S$49, S$79 or S$99 per listing), and buyers deal directly with the owner. Browse online and e-commerce businesses, software and tech businesses, education and tuition businesses or all businesses for sale in Singapore. If you are ready to sell, you can list your business.

Frequently asked questions

Do I need my staff’s consent to share their details with a buyer?

Usually not during a genuine sale. The PDPA’s business asset transaction exception lets a seller disclose employee data without consent, but only what the buyer needs to decide, under an agreement limiting use to the deal, with notice after completion.

Can I share my customer list with a prospective buyer?

Only to the extent the buyer needs it to decide whether to proceed. Start with anonymised figures such as customer counts and revenue by segment, and release names later, after a purpose-limiting agreement is signed, and only if they are genuinely needed.

What must the buyer do if the deal falls through?

The PDPA says that if the business asset transaction does not proceed or is not completed, the buyer must destroy or return to the seller all the personal data it collected. Put this duty, and a confirmation step, in your NDA.

Who must tell staff and customers after the sale completes?

Either the buyer or the seller. The Act requires one of them to notify the individuals whose data was disclosed that the transaction has taken place and that their data went to the buyer. Agree in the sale agreement who does it.

Does the exception apply to a share sale?

Yes. A business asset transaction includes a sale of an interest in an organisation, such as shares. Paragraph 2 of Part 4 of the First Schedule applies similar conditions when a buyer acquires a seller’s interest in a company.

Does it apply to a sole proprietorship or partnership?

It can. The PDPA defines an organisation to include any individual, company, association or body of persons, whether incorporated or not. A sole proprietor or partnership selling its business can rely on the exception if it meets every condition.

Can the buyer use the seller’s customer data for marketing?

Only for the purposes the seller was allowed to use it for. If customers had agreed to the seller’s marketing, that can generally continue. A new purpose needs consent or another PDPA basis, and Do Not Call rules still apply.

Is a standard NDA enough for the PDPA?

Not always. The Act needs an agreement requiring the buyer to use or disclose personal data only for purposes related to the transaction. Check that your NDA says so expressly, and add security, return and destruction terms for personal data.