Anonymised, illustrative composite. A single roll-up acquiring four regional operators in four provinces asked one question of its post-closing checklist: who notifies customers after closing. The privacy statute governing each deal answered differently.
At a glance
A national consolidator in a fragmented service industry closed four regional acquisitions inside one quarter: one target based and operating solely in Alberta, one in British Columbia, one in Quebec, and one operating only in a province with no private-sector privacy statute of its own, leaving PIPEDA as the sole federal default. Each deal moved a comparable body of customer records — a few thousand accounts per target — under a business-transaction exemption from consent.
Integration built one post-closing playbook for all four, on the assumption that “notify customers within 30 days of closing” was a safe, uniform practice regardless of which statute actually governed each deal.
The assumption of uniformity was wrong on both axes it needed to be right on: whether notice was required at all, and who was responsible for giving it. Four statutes, four different answers, verified side by side rather than assumed to track each other because they share a common ancestor in structure.
Because the playbook defaulted to the strictest available reading — notify in all four cases, buyer sends the notice — the practical cost of the mismatch was mostly wasted effort rather than a compliance gap: unnecessary customer communications in Alberta, where none was legally required, and a notice sent by the wrong party in Quebec before counsel caught it. The Quebec correction required a second, corrective notice, because the first had gone out over the vendor’s name.
Read the unit, province by province — the answer is not portable. Alberta’s Personal Information Protection Act s.22(3)(b) permits use and disclosure once a business transaction is completed “if… (i) the parties have entered into an agreement under which the parties undertake to use and disclose the information only for those purposes for which the information was initially collected… and (ii) the information relates solely to the carrying on of the business or activity… for which the business transaction took place”. Notification to affected individuals is not among the conditions. A deal governed by Alberta law can complete lawfully with no communication to customers at all.
British Columbia is different. Its PIPA s.20(3) permits an organization to disclose personal information on completion “on condition that… (c) the employees, customers, directors, officers and shareholders whose personal information is disclosed are notified that (i) the business transaction has taken place, and (ii) the personal information about them has been disclosed to the party”. The subsection conditions the disclosing organization’s own right to disclose on that notice happening; it does not, on its own wording, name which of the parties must be the one to send it — a real difference in specificity from Quebec’s provision, and worth reading carefully rather than assuming the vendor is meant.
Quebec is the most explicit of the four. Its Act respecting the protection of personal information in the private sector s.18.4 puts the duty on the recipient by name: “Within a reasonable time after the commercial transaction is concluded, that party must notify the person concerned that it now holds personal information concerning him because of the transaction.” “That party” is the acquirer — the organization that received the information — not the vendor that disclosed it. Quebec is also the only one of the four regimes with no return-to-vendor alternative if the deal collapses: its pre-closing agreement condition requires the recipient “to destroy the information if the commercial transaction is not concluded”, full stop, where PIPEDA s.7.2(1)(a)(iii) and Alberta s.22(4) both give a choice between destruction and returning the information to the disclosing party.
PIPEDA governs the fourth deal by default, and its s.7.2(2)(c) sits between the other three: “one of the parties notifies the individual, within a reasonable time after the transaction is completed, that the transaction has been completed and that their personal information has been disclosed under subsection (1)”. Either party may do it; the statute does not care which, so long as it happens.
The integration team rebuilt the playbook as a lookup table keyed to the target’s governing jurisdiction rather than a single rule: no notice required in Alberta (though one was sent voluntarily, as good customer-relations practice, clearly not framed as a legal requirement); notice confirmed as given in British Columbia before the vendor released the records; notice sent under the acquirer’s own name in Quebec, correcting the earlier error; and notice sent by the acquirer, matching PIPEDA’s practice default, in the fourth province.
The Quebec error — a notice sent by the vendor, when s.18.4 names the acquirer — is a small thing to fix with a correction notice, but a Quebec regulator assessing whether the acquirer met its own statutory notice duty would not treat a vendor-sent notice as satisfying an obligation the statute places on the acquirer specifically. Left uncorrected, it would have been a live compliance gap dressed up as a completed task.
Any post-closing privacy playbook written as one rule for every jurisdiction is a tell on its own. The right question for each target is not whether customers were notified, but which governing statute applied to that specific target and what it specifically required, if anything, and of whom — four different targets in four provinces can and did produce four different correct answers to the same operational question.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
