Customer data is one of the most important assets of many asset deals. If they are not transferred correctly, however, they are worthless for the buyer. In addition, it can be expensive for both the selling and acquiring company.

In accordance with the currently applicable Federal Data Protection Act / Bundesdatenschutzgesetz (BDSG), fines of up to 300,000 euros may be imposed for breaches of data protection regulations. On this basis, the Bavarian State Office for Data Protection (BayLDA) imposed fines of five-digit amounts on the seller and the buyer at the end of July 2015. The General Data Protection Regulation (GDPR), which will come into force on 25 May 2018, does not change the legal relevance of a customer data transfer in the asset deal. However, the fines are increased to up to 20 million euros and can even be exceeded for companies.

It is therefore not only for buyers that there is still reason enough to deal intensively with the transmission and use of customer data in an asset deal. I have already discussed the legal situation under the BDSG and the Act Against Unfair Competition (UWG) in my article on LTO, which can be downloaded here (only in German language). However, with a view to 25 May 2018, the question arises as to what changes will result from the GDPR. Against this background, the principles of the above-mentioned article are summarized in the following and compared with the future legal situation:


In the case of customer data which the buyer wishes to continue using as part of the continuation of the respective contractual relationship, there are no data protection concerns if the customers have consented to the transfer of their contractual relationship. This principle remains.
The buyer can only use the customer data received for his own advertising e-mails or telephone calls on the basis of a consent originally given by the customers to the seller and in favour of the seller, if the consent can be transferred in favour of the buyer. Whether this is possible requires an individual case study. This principle remains.
If the seller was entitled to send advertising e-mails in accordance with § 7 para. 3 UWG, the buyer may also invoke the competition law exemption if he essentially continues the business operations under the old company. This principle remains.
So-called “list data” such as the name, address or year of birth can be transmitted to and used by the buyer for advertising purposes in the context of letter advertising, if

·       the respective advertising measure of the buyer contains a reference to the origin of the data, i. e. the seller, and

·       the seller stores the information on the origin of the data as well as the buyer to whom the data were transmitted for a period of two years and provides the respective customer with information on request.













Personal data can be transmitted to and used by the buyer for the purpose of mail advertising if

·       the respective advertising measure of the buyer contains a reference to the origin of the data, i. e. the seller.




Admissibility is assessed according to Art. 6 para. 1 lit. f GDPR. In accordance with the recital 47 GDPR: “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”


The obligation to inform the user of the origin of the data follows from the general principles according to Art. 5 para. 1 GDPR.


Storage obligation is not provided according to the GDPR and is also not necessary in the case of an asset deal, because the customer may exercise his right of objection in accordance with Art. 21 para. 3 GDPR directly towards the buyer. However, there is something else in cases where the seller remains “responsible” (see Art. 15 para. 1 lit c GDPR)

Other data (i. e. no “list data”) can be transmitted to the buyer for advertising purposes and used by the buyer for e-mail and telephone advertising, if the respective customers have given their explicit consent in each case.


This principle remains.


However, the written form requirement for consent to data transmission is not applicable (see. Art. 6 GDPR).

Consent to the receipt of advertising (e. g. registration for a newsletter) which has already been given to the seller can in individual cases justify the admissibility of a data transfer to the buyer and the further dispatch of advertising by the buyer if the buyer essentially continues business operations under the old company. This principle remains.


Additional information:

  1. the previous assessments imply that the buyer is initially permitted to process data and comply with the necessary information obligations (Art. 13 para. 1 lit. c and e GDPR or Art. 14 para. 1 lit. c and e GDPR). These aspects must be examined separately in the context of an asset deal. If the customers have not been informed in advance about the purposes of the advertising processing and/or (at least) the categories of recipients in the context of a company sale, there is a need for a recourse to Art. 6 para. 4 GDPR. In this case, however, the seller’s obligation to provide prior information in accordance with Art. 13 Abs. 3 GDPR should be considered.


  1. Since the ePrivacy Regulation was only available in draft form at the time this article was written, it was not taken into account in the assessment. Should the final version of the ePrivacy Regulation result in any changes to the above-mentioned results, these will be pointed out separately at a later date.