Data retention before selling a business: what not to delete before the sale

Why a pre-sale cleanup needs a retention check

Before selling a business, keep old systems, archives and tool histories until counsel has cleared legal holds and retention rules and someone has assessed what the records are worth. Pre-sale cleanups often cancel legacy software subscriptions to trim costs and purge shared drives to tidy the data room, and once a vendor closes a cancelled account, that history may be unrecoverable.

Two separate questions need answers before anything is deleted. The first is legal: what must be kept for litigation, tax, regulatory or contractual reasons, and what must be deleted under privacy commitments. The second is commercial: which histories help a buyer's diligence, and which could support a separate data license for a company with 50+ full-time employees at peak (contractors excluded).

Privacy law cuts both ways. For businesses it covers, California's CCPA at Civil Code section 1798.100 requires telling consumers at collection how long personal information will be kept, and limits retention to what is reasonably necessary and proportionate. Keeping everything forever is not the answer either; counsel decides record set by record set.

The pre-sale retention checklist

Work through each group with the CFO, the IT lead and outside counsel before the first cancellation notice goes out.

Before anyone cancels a tool

• List every subscription and legacy system due for cancellation or retirement in the next two quarters, with its owner and renewal date.
• Confirm for each one whether a complete export is possible, including history, attachments and comments, not just a list of current records.
• Read the vendor terms on what happens to data after cancellation, and note the date access ends.
• Name the person who will run each export and where the export will be stored.

Legal and compliance gates

• Ask counsel to confirm any litigation holds, regulatory retention periods and tax record requirements that apply.
• Check the retention periods promised in privacy notices and customer contracts, and flag records that must be deleted on schedule.
• Check what the company promised about how customer data would be used; FTC staff have said that promises not to use customer data for purposes such as model training are enforceable.
• Separate health, financial and consumer personal data, which carry their own rules.

Records worth assessing before they go

• Mailboxes of departed employees, especially long-tenured managers and account leads.
• Slack or Teams workspaces inherited from acquired companies.
• Help desk and ticketing history, with resolution notes.
• CRM activity: emails, call notes, stage changes and lost-deal reasons.
• Project, engineering and code history: tickets, pull requests and reviews.
• Finance records beyond the ledger: approvals, exceptions and vendor correspondence.
• Call recordings, along with the notices under which they were recorded.

Ownership and access

• Admin credentials for every system sit with the company, not with a departed employee or an agency.
• Records created by contractors and agencies are identified, since the company may not own them.
• Data held on behalf of clients is marked and kept apart.

How to use the results

Which histories to save first

Not every system is equally at risk. Prioritize by how fast history disappears and how hard it would be to rebuild.

The guide to post-merger data migration explains how to decide what to migrate, archive or retire, and the guide to data questions in a secondary buyout shows why buyers ask for this history.

Red flags

• A shared drive or mailbox was purged after a dispute or a demand letter arrived; stop and call counsel.
• Nobody knows the admin password for a system that holds years of history.
• An agency or IT provider holds the only copy of a key archive.
• Customer contracts promise deletion at the end of service, and the records were kept anyway.
• Someone plans to sell records straight to a data buyer outside any structured process; the page on why companies should not sell data directly covers the risks.

Where a data license fits

For a company with years of company-owned records, the months before a sale are a sensible time to test whether those records can be licensed, because the inventory work overlaps with diligence preparation. An operating partner can run a quick company fit check against the baseline for qualifying companies and decide whether to make an introduction before the cleanup starts; the private equity operating partners page explains how.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Next step

Freeze cancellations of systems with long histories until the checklist is complete. If the company passes a fit check, register as a partner and make the introduction, or send the CEO to sourcex.si/apply to apply directly.