If a small business is covered by the Privacy Act, the potential purchasers will have to take care to protect individual's privacy rights in the due diligence process. Inspecting Purchasers will need to comply with the National Privacy Principles if they collect personal information. Taking notes which include personal information or taking a copy of a document, which has personal information in it, is collecting personal information.

Only personal information necessary to assessment of business should be reviewed. De-identified information should be relied on wherever possible. Generally, purchasers would be able to review:

• financial information
• contractual documents with trading partners, suppliers and contractors
• information about key employees relevant to their employment relationship
• aggregated information about employee entitlements (long service leave etc)
• aggregated statistical customer information

Prospective purchases must take reasonable steps to protect the privacy of any personal information and comply with privacy clauses included in confidentiality agreements. Generally purchasers should only inspect and not copy documents. Personal information collected by the prospective purchaser should be returned or destroyed after due diligence is complete.

For more information see Information Sheet 16-2002: Application of key NPPs to due diligence and completion when buying and selling a business.