Anonymised, illustrative composite. The purchase agreement carved out one division cleanly on paper. The systems behind it had never heard of the carve-out, and British Columbia's privacy statute does not let the systems catch up after closing.
At a glance
A mid-market British Columbia distributor operated three divisions — industrial fasteners, safety equipment, and packaging supplies — sharing one back office. HR, the CRM and payroll all ran on a single instance per system across the whole company; nothing in any of the three systems tagged a record by division, because until the sale process began, nothing had ever needed to.
The vendor agreed to sell the fasteners division alone, by way of an asset purchase carving out that division’s inventory, contracts, equipment and 34 employees, while retaining the other two divisions and their combined 91 employees.
The purchase agreement described the carve-out cleanly: fasteners in, everything else out. The underlying systems could not honour that line. A CRM export pulled every customer record in the company, tagged by account manager and product category but not by division in any structured, reliable way — a customer buying both fasteners and safety equipment appeared once, with mixed order history. Payroll and HR held all 125 employees in one database with no clean division flag for a meaningful minority of records, because some staff had moved between divisions over the years without their historical records being re-tagged.
Of roughly 3,400 customer accounts in the CRM, 2,050 were fasteners-only, 890 were exclusively in the other two divisions, and 460 were mixed-division accounts requiring manual review. Building a clean, division-scoped export — rather than simply handing over the whole database and letting the buyer sort it out — took a data analyst and outside privacy counsel five weeks and roughly $61,000, work that had not been budgeted anywhere in the transition services agreement.
Read the unit. BC’s Personal Information Protection Act does not permit a company completing a divisional sale to hand over whatever a shared system happens to export. Section 20(3) allows disclosure on completion “on condition that… (b) the disclosure is only of personal information that relates directly to the part of the organization or its business assets that is covered by the business transaction”. The scope limit is not a drafting nicety in the purchase agreement — it is a statutory ceiling on what the vendor is permitted to disclose at all, regardless of what the systems make convenient to export.
PIPEDA’s equivalent business-transaction exemption has no comparable clause confining a completed disclosure to the part of the organization actually sold; BC’s does, and on a divisional carve-out that gap is the whole compliance problem. Where PIPEDA governs, an over-broad export from a shared system is a data-minimization and good-practice issue; where BC PIPA governs, it is a disclosure the statute does not authorize at all.
The mixed-division accounts made the point concretely: a customer record split across two divisions’ order history “relates directly” to the fasteners division only in part, and the safety-equipment portion of that same record does not relate to the covered transaction at all. Handing the buyer the whole record, unsegmented, would have disclosed personal information relating to a division that was never sold — not a technical breach, a disclosure with no statutory authorization behind it.
Section 20(6) added a second, separate constraint on this file: two competing bidders had received a limited pre-signing data set on the fasteners division under s.20(2)’s prospective-transaction exemption before the vendor chose the eventual buyer. That subsection requires that “if a business transaction does not proceed or is not completed, a prospective party must destroy or return to the organization any personal information the prospective party collected under subsection (2)”. Both unsuccessful bidders had to certify destruction before the deal with the winning buyer closed.
The vendor built a one-time segregation project rather than relying on any system’s native export function: a manual review classified all 3,400 CRM accounts and 125 HR/payroll records by division, split the 460 mixed accounts into division-scoped sub-records, and produced a fasteners-only data set that was disclosed to the buyer at closing. The two unsuccessful bidders confirmed destruction in writing before closing.
Had the vendor exported the full CRM and HR databases and let the buyer filter for the fasteners division after the fact — the path of least resistance given the systems in place — the disclosure of the other 91 employees’ and roughly 890 customers’ records would have had no basis under s.20(3)(b) at all, exposing the vendor to a complaint over data belonging to a business it had never sold.
“Just export the whole system, they only need the fasteners piece” is the sentence that misses s.20(3)(b) entirely on a BC-governed divisional sale. The tell is any carve-out transaction where the underlying systems are shared across the retained and sold businesses — the scope limit in the statute does not bend to what the software makes easy.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
