Selling your accounting practice means handing over relationships, systems and records that clients have trusted you to protect. A buyer needs enough information to assess the business, but that does not give them unrestricted access to every client file.
GDPR and client data rules when selling a practice need attention from the first buyer conversation through to the final handover. In the UK, personal information is governed by the UK GDPR and Data Protection Act 2018, as amended. Professional confidentiality obligations apply alongside those rules.
Start by identifying your data, deciding what can be shared and documenting the reasons. This guide explains how to manage disclosure throughout a sale.
Identify the data you hold
Start with a practical inventory. Include tax records, payroll files, identification documents, email correspondence, archived folders and information stored in practice management software. Company engagements can still contain personal data about directors, employees and customers.
Separate commercial information from information relating to identifiable individuals. A practice’s total annual fees may reveal little about a person, while a named sole trader’s income and tax position can reveal considerably more.
Check for special category information, such as health details in payroll records. Sharing it requires an appropriate additional condition as well as a lawful basis. Flag criminal offence information for separate legal assessment. Your data inventory should show where files sit and who currently has access.
Confirm who controls the information
The sale structure affects the data protection analysis. In an asset sale, client information may move to another legal entity acting as a new controller. A straightforward share sale may leave the existing company as controller, although disclosures to buyers and advisers still need assessment.
Look at who decides why and how the information is used. A prospective buyer assessing an acquisition should not automatically be described as your processor. Different participants may have different responsibilities.
Record those roles early. The distinction also matters when preparing your due diligence checklist and deciding which documents buyers need.
Choose a lawful basis for sharing
Identify and document the lawful basis before disclosing personal data. The fact that a sale is commercially useful does not settle that question. Assess the purpose of each disclosure and whether it fits the intended use of the information.
Where ordinary legitimate interests is appropriate, complete an assessment covering the purpose, necessity and balance against individuals’ interests and rights. Consider whether a less intrusive approach would achieve the same result.
Do not assume GDPR consent is always required, or that it is never needed. Permission to transfer an engagement and permission to disclose confidential information involve separate considerations. Review contractual terms and professional duties alongside data protection law. Take transaction-specific legal advice where the position is unclear.
Prepare before sharing client information
Speak to Sell Practice about organising your sale and managing buyer enquiries alongside advice on your confidentiality and data protection obligations.
Share less during early discussions
A buyer can often evaluate initial suitability using aggregated fee totals, service categories and broad client concentration figures. Start there before revealing identities or detailed personal records.
Replacing names with reference numbers is usually pseudonymisation, rather than proof that the data is anonymous. If people remain identifiable using other details or additional information, data protection obligations may continue to apply. A niche sector, location and unusual fee level can sometimes identify a client indirectly.
Use staged disclosure as a practical control. The appropriate information depends on the purpose, the safeguards and the legal assessment at each stage. Our guide to client confidentiality explains the wider responsibilities involved.
Control buyer access
Before detailed disclosure, agree confidentiality terms and clear restrictions on use. An NDA is useful, but it does not supply a lawful basis or override a duty owed to a client.
A secure data room can help you limit access to authorised individuals, record activity and withdraw permissions. Use individual accounts, appropriate authentication and restricted downloads where suitable. Remove irrelevant details from sample files rather than uploading complete folders by default.
Document which information may be shared, with whom, for what purpose and for how long. Agree how security incidents and failed negotiations will be handled. Assess overseas access and cloud arrangements separately where international transfer rules may apply.
Keep clients properly informed
Plan communications before completion. Where a buyer becomes a new controller, individuals generally need information about its identity, purposes, lawful basis, retention and their rights. Updating a privacy notice without making it available to the people concerned may not be sufficient.
When information is obtained from another source, privacy information is generally due within a reasonable period and no later than one month. Earlier communication or disclosure can bring that deadline forward; applicable exceptions need assessment.
Coordinate the privacy information with client introductions and engagement arrangements. Explain who will handle their work and how they can raise questions. Clients should not first discover that their records have moved when an unfamiliar firm contacts them about an overdue invoice.
Agree the file handover
Set out the agreed transfer in writing, including the records involved, the receiving party, security arrangements and responsibility for outstanding requests. A data sharing agreement can record these decisions alongside the sale documents.
Check that transferred files are accurate and usable. Reconcile folder lists, confirm delivery and identify missing records before switching off old systems. Give the buyer access through authorised account arrangements rather than sharing personal login credentials.
Use this staged checklist for preparation. Each disclosure still requires its own legal assessment.
| Sale stage | Suggested disclosure | Practical safeguard |
| Initial enquiries | Aggregated business information | Check that individuals cannot be identified |
| Detailed due diligence | Necessary, lawfully shareable records | Control recipients and redact irrelevant details |
| Completion | Agreed client records | Secure transfer and document receipt |
| After completion | Records needed for defined purposes | Review permissions and retention |
Make due diligence easier to manage
Our team can help you plan the commercial information buyers need, so your advisers can assess the appropriate disclosure at each stage.
Retain records for a clear reason
Completion does not mean the seller must immediately erase every record, nor does it justify keeping a complete duplicate indefinitely. Assess legal and regulatory retention duties, insurance arrangements and the need to defend claims.
Document what you retain, why, for how long and who can access it. A subject access or erasure request still needs proper handling; erasure is not an absolute right in every situation.
If the deal falls through, withdraw buyer access and follow the agreed return or deletion arrangements, subject to justified retention requirements. Assign responsibility for any remaining copies and backups. Avoid relying on a vague promise that the buyer will tidy everything up later.
Check access after completion
Review permissions once the transfer is complete. Remove access that is no longer needed, confirm the buyer can meet current deadlines and identify who will respond to client questions or data rights requests.
Keep a clear incident reporting route. If a personal data breach occurs, assess the risk promptly. Where notification to the ICO is required, the deadline is generally within 72 hours of awareness, where feasible. High-risk breaches also require informing affected individuals without undue delay.
Sell Practice can help coordinate buyer discussions and commercial preparation alongside your legal and data protection advisers. Treating data handling as part of the sale plan helps protect client confidence throughout the transition.
