What happens to customer data when a business is sold?

Does customer data transfer to the buyer?

In most sales, customer data goes to the buyer along with the business, but the buyer inherits the promises the seller made about it. If the seller told customers their information would be used only for certain purposes, those promises generally still bind how the data can be used or transferred.

The answer changes by deal structure, by the kind of data and by what customers were told. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What do regulators say about promises made to customers?

Two FTC staff posts are useful reference points. In January 2024 FTC staff wrote that companies' promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable, whether made in privacy policies, terms of service or other materials. In February 2024 they added that it may be unfair or deceptive to adopt more permissive data practices and tell consumers only through a surreptitious, retroactive change to terms.

Neither post is a rule on business sales. They show how regulators read privacy commitments, which is the lens a buyer's counsel will use on a transferred customer file.

How does the deal structure change the answer?

For bankruptcy sales, the Bankruptcy Code addresses the case where a debtor's privacy policy prohibited transferring personally identifiable information. Under 11 U.S.C. 363(b)(1) the trustee may sell it only in limited circumstances, and section 332 provides for a consumer privacy ombudsman appointed by the United States trustee. In a reported 2025 case, the ombudsman recommended that any transfer of customers' genetic or personally identifiable data be prohibited absent renewed opt-in consent. That is a recommendation reported in the press, not a court ruling.

What about state privacy laws?

State laws add consumer rights on top. California's law, for example, gives consumers rights to know, delete and opt out of the sale or sharing of their personal information, as the California Attorney General's overview explains. Whether a given business is covered depends on thresholds and on the data it holds. Other states have their own laws, and sector rules can apply on top. Counsel for the buyer and seller sort this out in diligence.

Is consumer data the same as operational records?

No, and the difference matters for data licensing. SourceX treats a dataset that is mainly consumer personal data with no licensing basis as a red flag. A company whose valuable records are internal documents, tickets, finance and engineering workflows, and operations records can still qualify, because those records describe how the company works rather than who its consumers are.

De-identification and redaction rules are agreed with the company before any work begins, and nothing is delivered without an executed agreement and the company's authorization. The guide on telling company data from data owned by its customers walks through the test, and the page on whether a business can sell or license its customer list covers lists directly.

What should a seller do before closing?

• Read the current and past privacy policies and customer terms in effect when the data was collected.
• List the systems that hold personal data and the categories inside them.
• Separate consumer personal data from internal operational records.
• Preserve exports of archived systems before migration; see archived or legacy system data.
• Ask counsel what notice or consent the buyer's planned use needs.
• Agree in the purchase agreement what the buyer may do with the data.

For a software seller the same questions apply to product data; the SaaS company guide covers it.

Next step for referral partners

Partners never handle or describe confidential records; they introduce the company and give basic fit information. If a client's main asset is a consumer database, say so early and point to the company fit checker rather than promising a licensing outcome. Register as a partner to introduce companies whose operational records qualify.