If you might sell your business one day, here is something that changed on 1 July and that a lot of owners have missed. You may now have a privacy obligation you did not have before, and you may not even know it.
A wave of changes to the Privacy Act has just widened who it covers. From 1 July, the anti money laundering reforms pull a new group of businesses into the Act, so businesses that sat comfortably outside it can now be subject to it, often without realising. From 10 December, any covered business also has to disclose where it uses AI to make decisions about people. The compliance bar has moved, and for a lot of owners it moved without them noticing.
Why a seller should care now
Because a buyer will look for it. When you go to sell, the buyer’s lawyers run due diligence, and privacy compliance is becoming part of that list. They check whether you are subject to the Privacy Act, whether your privacy policy and collection statements are in order, how you handle customer data and whether any of it goes offshore. If you have become subject to the Act and done nothing about it, that is a gap they will find, and it is the kind of gap that makes a buyer nervous about everything else.
A nervous buyer does not usually cut the price outright. They protect themselves through the deal terms instead: tighter warranties about the data, more money held back at completion, more of the price made conditional on nothing surfacing later. The cost is real, it just shows up in the structure rather than the headline number.
There is a second reason it matters at sale. Your customer database is often part of what a buyer is paying for, and it is only worth what they can lawfully use. If your consents and privacy policy never contemplated handing the list to a new owner, the buyer may not be able to use the very asset they are buying, and they will price that in.
Get organised well before you find a buyer
This is the whole point. Sorting your privacy position while you are still running the business, with no buyer in the room and no clock running, is a small, contained job: work out whether the 2026 changes have caught you, put a privacy policy and collection statements in place that match what you actually do, map what data you hold and where it goes, and make sure your consents would let the database transfer to a buyer. Done in advance, it is straightforward and cheap. Left until a buyer’s lawyers raise it, it is slow, costly, and negotiated from the back foot.
We see owners spend years getting everything else ready for a sale and leave this untouched, then lose ground in the deal over paperwork that would have taken a fraction of the time and money to sort a year earlier. The sellers who handle it well treat privacy as part of getting sale-ready, not as a problem to deal with when a buyer raises it.
What to do about it
The move is to get ahead of it, well before you go looking for a buyer.
If you are thinking about selling, even years out: get a privacy review done now. We will work out whether the 2026 changes have caught you, get your privacy policy, collection statements and consents into shape so your customer data is an asset a buyer can use, and take it off the list of things that can cost you in a deal. Book a free 15-minute call and we will tell you what it would involve.
If you advise or broker for sellers: worth raising early, because a seller who gets organised in advance keeps the value a buyer’s due diligence can otherwise chip away. Add it to the sale-readiness conversation, point your clients our way, or book a call and we will work through it with them.
