Site Changes

On 1 November 2010 the Office of the Privacy Commissioner was integrated into the Office of the Australian Information Commissioner and a new website established at www.oaic.gov.au.

Note 1: Major changes to the Privacy Act 1988 will come into effect in March 2014. Agencies, businesses and not for profits need to start preparing for these changes. For more information go to our privacy law reform page at www.oaic.gov.au
Note 2: From 12 March 2013 content is no longer being added to, or amended, on this site, consequently some information may be out of date. For new privacy content visit the www.oaic.gov.au website.

What happens if I sell my small business including a customer database?

A business which sells its assets, including personal information held in the customer database, is trading in personal information and will have to comply with the Privacy Act unless:

it has the consent of the individuals concerned before the sale is made; or
the sale of personal information is required or authorised by law.

A sale of business is not trading in personal information, and the business will not have to comply with the Privacy Act, if the sale involves a change of ownership, or a sale of shares, of the business but the personal information is kept within the business. In this case, the business may have new shareholders, but the business itself has not given the personal information to anyone outside the business.

For more information on whether or not your small business is exempt from the Privacy Act see Privacy Checklist for Small Business 2002 and Information Sheet 16-2002: Application of key NPPs to due diligence and completion when buying and selling a business.