Anonymised, illustrative composite. Every regulatory approval was obtained, every escrow released, every closing deliverable ticked off. One PIPEDA obligation only starts once the deal is already done, which is exactly why it fell off the list.
At a glance
A direct-to-consumer subscription-box retailer sold its customer list, brand and fulfilment operations to a strategic buyer by asset purchase. The deal itself was unremarkable: financing closed on schedule, the vendor’s holdback released after the survival period, and a six-month transition services agreement ran its course without incident.
The purchase agreement had relied, correctly, on PIPEDA’s business-transaction exemption to move 19,000 customer records without individual consent at signing and again at closing. Counsel had built the pre-closing agreement to s.7.2(1)’s specification. What nobody built into any document, calendar or checklist was the obligation that only arises once the deal is already done.
Every standard closing checklist item — regulatory approvals, funds flow, escrow release, key employee retention — gets ticked off at or shortly after closing and the deal team disbands. PIPEDA’s post-closing notice duty does not fit that pattern: it is a positive obligation owed to people outside the transaction, on a deadline that only starts running once the file most people consider finished is, in fact, finished.
It surfaced two years later, and only by accident. The buyer migrated its marketing stack onto a new platform, and the migration tool required a consent-basis field for every contact before it would import a list. Roughly 19,000 records — the entire acquired customer base — had no consent basis recorded, because none had ever been required for them: they had moved under PIPEDA’s business-transaction exemption, not under individual consent, and nobody had translated that fact into the new platform’s data model, let alone into a completed notice obligation.
19,000 customer records, unremarked for roughly 25 months. Once flagged, the notification itself — a plain-language email explaining the 2024 transaction and confirming what information had moved — cost under $8,000 to draft, review and send. The two-year gap, not the notice itself, was the exposure: a regulator assessing whether notice was given “within a reasonable time after the transaction is completed” is unlikely to treat two years as reasonable on any reading of the phrase.
Read the unit. The obligation sits in a different subsection of the same section that authorized the original disclosure, and it runs on a different clock. Section 7.2(2) of PIPEDA — marginal note “Completed business transaction” — permits continued use and disclosure after closing only if, among the conditions listed, “one of the parties notifies the individual, within a reasonable time after the transaction is completed, that the transaction has been completed and that their personal information has been disclosed under subsection (1)”.
Two features make this provision easy to miss. First, it is triggered by completion, not signing — the pre-closing agreement under s.7.2(1) is the document deal teams draft and diligence; s.7.2(2)’s notice duty only comes due once that stage is already behind everyone. Second, “one of the parties” may perform it, so unlike some provincial equivalents there is no statutory default assigning the job to buyer or vendor — which in practice means it is nobody’s job unless the purchase agreement says whose it is.
This is also the only privacy obligation in the whole business-transaction framework owed to a third party rather than to a regulator or a counterparty. There is no closing deliverable, no funds-flow line item and no escrow condition that forces it to happen, because it is not a condition of anything closing — it is a freestanding duty that survives the closing and outlives the deal team’s attention to the file.
Once flagged, privacy counsel confirmed there was no record anywhere in the deal file — not the purchase agreement, not the transition services agreement, not any post-closing memo — assigning the s.7.2(2)(c) notice to either party. The buyer sent the notice to all 19,000 affected individuals, more than two years after completion, describing the 2024 transaction and what information had moved. No complaint had been filed with the Privacy Commissioner at the time of remediation, but the buyer could not represent that notice had been given “within a reasonable time” — only that it had now, belatedly, been given at all.
Had a complaint reached the Privacy Commissioner before the gap was caught internally, the buyer would have had no argument that the s.7.2(2)(c) condition had been satisfied on its own terms — only that it eventually complied once the deficiency surfaced. That is a materially weaker position than being able to show a notice sent inside, say, 60 or 90 days of closing, and it would have been discovered by a regulator rather than by an internal data-migration project the buyer happened to run on its own timeline.
Ask any deal team, three months after closing, who owns the s.7.2(2)(c) notice and watch for silence. It is not on a funds-flow memo, not on a regulatory-approval tracker, and not on a 90-day post-closing integration plan unless someone put it there on purpose — because unlike almost everything else in a closing checklist, its clock starts only once the checklist itself is done.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
