Business succession: handing over website and customer data

Successions end in very different ways. A meta-analysis by the IfM Bonn covering 23 (IfM Bonn) empirical studies concludes that a good half of owners – 54 % (IfM Bonn) – handed their business over to their children or other family members. About 17 % (IfM Bonn) transferred it to employees, and a further 29 % (IfM Bonn) to external managers, other companies or other outside parties. For the digital part, this makes a difference. Someone taking over from within may have used the logins before. Someone coming from outside knows none of it: not the hosting provider, not the mailbox through which the Google profile was once verified, and not the list that receives the maintenance reminder every autumn.

Legally, the form of the sale determines how much work the customer data involves. In a share deal, only the shares in a company change hands; the company remains the controller of its data, and in data protection terms nothing is generally transferred. In an asset deal, by contrast, the successor buys individual assets – machines, vehicles, the business name, the customer base – and continues the business under their own responsibility. The German Data Protection Conference, the joint body of the independent federal and state supervisory authorities, adopted a resolution on this on 11 September 2024 (DSK). It states that sole traders, craft businesses and partnerships in particular face additional challenges in a business transfer that do not arise at all in a share deal – which is only open to corporations. That is the typical case for a craft or family business in the region.

In an asset deal, the customer file is not an asset like a vehicle lift. With the sale, the controller within the meaning of the General Data Protection Regulation changes, and every transfer to the successor needs its own legal basis. The resolution of the Data Protection Conference therefore starts before the sale: during the negotiations, that is before the contract is concluded, transferring personal data to potential buyers is generally not permitted. It only provides for exceptions with the consent of the individuals concerned or, in individual cases, for particularly important business partners. In this phase, the prospective buyer gets revenue, customer groups and order volumes, but no list of names. After the contract is signed, the resolution distinguishes three groups of customers, each with its own rules, plus two special cases that cut across them.

For the first group – people with whom the outgoing owner is currently discussing an order – the following applies: if the customer continues the discussions with the successor on their own initiative, processing the data required for this is covered. Otherwise, the outgoing owner may transfer the data if the customers' interests do not override this. According to the resolution, an objection route generally takes account of this: the transfer is announced with a reasonable period of about 6 weeks (DSK resolution 2024) for a possible objection. In practice, this means: the letter goes out around six weeks before the planned data transfer, names the successor, explains which data is passed on and for what purpose, and offers a simple way to object – a reply by post, by email or a phone call. Anyone who objects is removed from the data handed over.

The second group is larger than many outgoing owners expect. A contractual relationship counts as ongoing not only while work is being done, but as long as obligations under it still exist – right up to warranty for defects. The resolution explicitly points out that warranty claims regularly only become time-barred after several years and that an ongoing relationship is to be assumed until then. If the successor takes over these contracts with the approval of the customers required under civil law, they can process their data to perform the contract. For a roofer, a joinery or a heating engineer, this means: the list of building sites from recent years is not a burden from the past but the core of the handover. It should be available before the handover date with the acceptance date and warranty status.

From the handover date, the successor becomes a controller in their own right and takes on their own obligations. According to the resolution, they must inform the customers whose data they have received under Art. 14 (GDPR) – within a reasonable period, at the latest one month after receiving the data, and with a note on their right to object, unless an exception under Art. 14(5) applies. Many businesses combine this information with the new owner's welcome letter: a letter or email introducing themselves, naming the team and enclosing the privacy information. The letter should stay factual: if it contains advertising, the rules in the next section apply.

Many successors want to keep the established name – for good reason, because customers find the business under it. For merchants within the meaning of the German Commercial Code, section 22 paragraph 1 (HGB) provides that the buyer may continue the existing business name, even if it contains the name of the previous owner, provided that the previous owner or their heirs expressly consent. The flip side is in section 25 paragraph 1 (HGB): anyone who continues a commercial business under the existing name is liable, with or without a succession suffix, for all liabilities of the previous owner incurred in the business. Under section 25 paragraph 2 (HGB), a deviating agreement only takes effect against third parties if it has been entered in the commercial register and published or communicated to the third party by the buyer or seller. If the business name is not continued, the buyer is only liable under section 25 paragraph 3 (HGB) if there is a special reason – in particular if they have announced the assumption of liabilities in the manner customary in trade.

For the website, these are not side notes. A sentence such as “We are taking over all obligations of our predecessor” on the handover page reads as friendly, but may be exactly the kind of announcement that section 25 paragraph 3 HGB refers to. Whether the successor continues the business name and how an exclusion of liability is registered or communicated is decided by the purchase agreement and legal advice, not by the website. The website implements this decision, with wording agreed in advance. Whether the business is registered in the commercial register at all, and which rules apply without registration, also belongs in this conversation.

The legal notice changes on the handover date. Under section 5 paragraph 1 (DDG, the German Digital Services Act), it must include, among other things, the name and the address at which the provider is established, the commercial register and registration number where registered, and any VAT identification number. In an asset deal, these details usually change: a new owner, possibly a new legal form, a new registration number, the successor's own tax numbers. From the handover date, the privacy policy names the new controller and their contact details; consent texts in forms and in the cookie notice follow suit. Which mandatory details apply in each case is summarised in our article on the legal notice requirements under the DDG.

The period between contract and handover date is the bottleneck. It has to accommodate the objection period, the waiting time in the Google profile and the domain transfer, and it usually falls in a phase in which the outgoing owner and successor are busy with banks, tax advisers and staff. It helps to assign the digital tasks to one person early on – internally or at the agency that looks after the website. After the handover date, the website needs the same regular care as before, just under the new name: updates, backups and logins are handled through ongoing website maintenance. And if the successor sees the takeover as an occasion for a new online presence anyway, the handover page can be embedded in a website relaunch; whether that pays off is covered in our article on when a relaunch is worth it.