How do I get my data privacy compliance in order before selling my business?

If you’re a small business owner, owning your company is a little like owning the family home. You put in years of sweat equity and refinancing. In the years that you spent nurturing the company, you’ve been nurturing all those other life parts. So plan the sale with similar care.

The price you get depends on how much you’re willing to put in the work. Buy a paint can, clean up the place, and stage it. Replace leaky faucets. Organize your paperwork. Get the work done to create that curb appeal and wow factor. Photographs and a well-organized house help, too.

Selling a house well takes a lot of hard work and a little money. Trimming the budget and the to-do list too short can leave money on the table.

Selling a business works the same way. It’s tempting to dump your old problems on an unsuspecting buyer, but that rarely works. Cleanup ups the value, draws serious buyers, and it can keep you safe from post-closing legal headaches.

Map Your Data Early, Before You Go on the Market

Data can be a valuable asset. But data’s also like the basement in a horror movie. If you have unmapped, noncompliant, murky basement data, you’re going to scare buyers off. It’s one thing to know your data is out there, and another to have it stored, organized, secure, and easy to find. Messy data isn’t just a waste of an asset — it can cost you your clients’ trust.

Before you sell, look at your company like a buyer and buyer’s investor would. To show how serious you are about selling, here are some steps to get your data ready.

Start with a data inventory, which shows what data has been gathered, how it has been and is being used, where it’s stored, who it’s shared with. A data inventory gives sellers and buyers a full look at the company’s digital assets.

An inventory also tells you where there might be compliance issues. Privacy laws are growing in number across countries and U.S. states.

The data inventory is a standard request for serious buyers, and some may run their own. Know what to expect, and what you might need to fix.

Buyers will have questions, like:

• What kind of data do you gather and store? Names, addresses, locations, phone numbers, usernames, passwords, financial details - make a list.
• Where did the data come from? A website form, a social media account, another channel? Log those origins.
• Where and how do you store data, and for how long? Know if you store it on your own equipment in-house, with an outside vendor like a cloud service.
• What do you use it for? Are you using it in-house to improve services, or are you using it for marketing? What parts of the data do you send to third-party platforms, like for shipping or loyalty programs?
• Do you share that data with any outside vendors, such as a marketing or website management firm? Is that data sold for others’ marketing purposes?

It helps to make a big all-hands meeting with IT, marketing, customer service, and operations. Follow a single data point through the company, like a customer name or credit card.

• What channels is it coming in through?
• What information do you collect?
• How does it travel from database to database?
• How and where does the data get used?
• Where is the data stored?
• Who has access to the data?
• What’s the weak link that could corrupt that data point?

Are you sure the data across all those different systems actually matches? You may find an employee’s name misspelled in a different database. If there’s a discrepancy, expect buyers to catch it and call you out, so resolve it or be ready to explain why.

A small company with a lean IT department can often handle their own analysis. But for more complex sellers, there’s often a lot of value in bringing in an outside firm.

The Paperwork

Once you have your inventory, the next step is getting all the paperwork together.

Just like the homebuyer who wants an appraisal or a title search to assure a fair price and no liens after closing, a business buyer needs evidence to know what they’re buying. They want to see a balance sheet for your business — what financial assets and debt you have. The customer data report provides a parallel assurance: a full list of the customer accounts you’ve acquired over the years, with details on who each customer is and what’s been sold to them.

Buyers want to feel like they’re getting a bargain, but not a Money Pit. The last thing they want is a house that’s going to leave them like Tom Hanks: pouring good money after bad into fixes that keep popping up. A clean inspection report signals you’re honest, thorough, and you aren’t going to surprise them with some hidden defect.

Here’s a short list to get you started.

• Privacy policy documents and information security policy documents
• Standard procedures and templates for responding to individual rights requests
• Your training materials for employees on their privacy responsibilities
• The most recent past privacy risk assessments
• Your data asset reports, broken down by type
• An active customer list with order details for each customer
• All other affiliates, legal partners, third-party processors, and vendors who have received personal data
• Have the normal metrics other companies in your industry put together

Arrange things so there’s one central place where you can pull up a map of what databases the company stores data in, find your standard documentation, and answer questions fast.

Privacy Laws

The EU’s General Data Protection Regulation (GDPR) is one of the broadest privacy laws on the books. But don’t forget that the U.S. has a patchwork of different state laws, with California, Virginia, Colorado, Utah, and Connecticut having their own rules. There’s not a U.S. federal law yet.

It’s best to build a comprehensive program that’s based on best practices, not trying to pick your way through each law. If your privacy policy is up to an industry standard, you may not need to shift your policies and practices with each new law passed.

These laws also mean you may be looking at not just who to sell to, but what can be sold.

Your policies, procedures and contracts may not allow you to share all your customer data. You may have to limit what you can share, or exclude some categories of data from the sale.

If you share data with or process data for a third-party, the buyer may have to limit how much they can use or share with that business.

No matter what size business you sell, potential buyers will have questions for you. Smart sellers go in with answers to questions they’re likely to be asked. If you aren’t sure of the answer, don’t try to wing it. The details, as with just about every aspect of this, are complicated, so it’s best to get expert advice.

Organizing your data at this scale can be intimidating, even if you have a long-time IT team in place.

Just like a seller’s agent protects your assets and reduces risks during a sale, an expert data advisor does the same by helping you handle your data disclosures and screening buyers to avoid the less serious ones. An expert data advisor can look at how you handle data, point you to weak spots, and help you get your files and documentation organized. There are two key issues to look at through a privacy expert.

One is whether the way you handle data meets regulatory expectations.

The second issue is not legal but strategic. If your sale will change the way you treat customer data, you need to consider the impact on customer trust and expectations.