A trail-book transfer is not permission to circulate an identified client database during due diligence. A buyer should first determine what information is genuinely needed, whether it can be aggregated or de-identified, who may see it and what legal basis supports each stage of access and transfer.

The transaction plan should separately cover pre-completion diligence, any migration at completion and post-completion client contact. Whether disclosure, consent or notification is required depends on the entities, information, transaction structure, original collection purposes and applicable agreements. Those conclusions belong with the parties’ privacy and credit-law advisers, not an assumption in the purchase model.

Start with the transaction structure and data map

Map the entities before mapping the files: the seller, buyer, licensee or credit representative, aggregator, lenders, technology providers, offshore service providers and proposed data-room users. Then record which entity holds or controls each dataset and which entity would receive it. A share sale in which records remain within the same company is not operationally identical to an asset transfer between entities.

The OAIC says personal information handling during a business sale is regulated where the Privacy Act covers the business. Its guidance also distinguishes a whole-business ownership change from buying or selling personal information and warns that selling assets including a customer database can amount to trading in personal information (OAIC — Selling a business; OAIC — Trading in personal information). A buyer should have a lawyer apply those distinctions to the actual sale structure rather than assuming that calling the records “part of the trail book” answers the privacy question.

Build a data inventory that separates:

  • loan and lender identifiers, balances, status, commission and repayment data;
  • client names, addresses, contact details and identity documents;
  • fact finds, serviceability material, bank statements and supporting financial records;
  • credit proposals, assessments, recommendations, file notes and correspondence;
  • complaints, hardship or vulnerability information and breach records; and
  • consent records, privacy notices, marketing preferences and contact history.

This matters because the current Privacy Act 1988 contains the Australian Privacy Principles covering collection, notification, use and disclosure, security, access and correction. It does not turn every transfer issue into the same test.

Stage due diligence from least to most identifiable

Begin with portfolio-level evidence: monthly trail receipts, lender mix, loan bands, arrears flags, vintage and run-off by cohort. If sampling is required, ask whether the seller can provide masked loan IDs and redact names, addresses, account numbers, identity documents and free-text notes. An exception register can describe missing or poor records without exposing the underlying client.

OAIC guidance says a vendor should consider de-identification and, when assessing its customer base, avoid providing names and other identifiers. It also suggests maintaining physical, legal and electronic control, including privacy clauses and limited data-room access. Prospective purchasers should generally avoid collecting personal information where possible; taking a copy or notes containing personal information can itself constitute collection (OAIC — Selling a business).

Use staged gates rather than opening the whole CRM:

  1. Aggregate review: no client identifiers; enough to test portfolio economics and concentration.
  2. Redacted sample: a defined selection with masked identifiers and restricted fields.
  3. Controlled exception review: supervised access to a narrow record set where an issue cannot otherwise be tested.
  4. Completion migration: only after conditions, permissions and transfer responsibilities are resolved.

For each gate, document purpose, approved users, fields, access dates, download and printing rights, monitoring, deletion or return, and incident escalation. The OAIC’s security guide recommends need-to-know access, limited administrator privileges and prompt revocation when access is no longer required (OAIC — Guide to securing personal information).

These are related but separate questions. APP 6 generally addresses use or disclosure for the primary purpose of collection, or a secondary purpose where an exception applies, including consent or a reasonably expected related purpose (OAIC — APP 6). APP 5 concerns reasonable steps to notify an individual of specified matters when an APP entity collects their information, including the entity’s identity, purposes, usual disclosures and privacy-policy information (OAIC — APP 5).

A client announcement is therefore not automatically evidence of consent, and a consent mechanism is not automatically the right answer for every transfer. Ask the lawyers and privacy specialist:

  • What was each category of information originally collected for, and what did the relevant notice and consent language say?
  • Does proposed diligence access constitute collection or disclosure, and by which entity?
  • What basis is relied on for the completion transfer and subsequent servicing use?
  • Are fresh notices, consents, lender or aggregator approvals, or client choices required?
  • Does the buyer intend to use the data for marketing beyond servicing, and has that use been separately analysed?
  • Will any recipient, storage location or support team be overseas?

Record the answer by data category and transaction stage. A broad warranty that the seller “complies with privacy law” does not identify who may export, receive, retain or contact each client.

Preserve records without granting uncontrolled access

Mortgage files may be needed to demonstrate prior credit assistance as well as to service future enquiries. ASIC’s best-interests-duty guidance lists records such as assessments, credit guides, application information, outcomes, conversations, recommendations, conflicts and file notes, and cautions that retention periods may depend on matters including the loan term and refinancing (ASIC RG 273). That supports a record-preservation plan; it does not by itself decide who can receive those records in a sale.

Before migration, reconcile the file index to the loan-level book and test a sample for completeness, format, encryption, permissions and successful restoration. Allocate responsibility for legacy systems, duplicate archives, email, recordings and paper files. Set dates for disabling seller and adviser accounts, rotating credentials, confirming backups, returning exported samples and obtaining deletion attestations. Keep an immutable migration log recording what moved, when, from where, to whom and with what exception.

Design the first client communication

The message should explain the change in plain language without overstating what has transferred. Subject to specialist advice and the applicable arrangements, the plan should identify who sends it, the timing relative to completion, the incoming entity and contact details, the intended servicing relationship, how privacy information can be found, and how questions, corrections, complaints or contact preferences will be handled.

Prepare scripts for returned email, disconnected telephone numbers, identity verification, vulnerable clients and clients who do not wish to engage. Separate an operational introduction from promotional marketing. Track delivery, bounce, response and follow-up status without treating a non-response as proof of consent.

Prepare for a transfer incident before moving data

Agree an incident playbook before the first identified record enters a data room. It should name the response leads, preserve logs, contain access, suspend migration when necessary, allocate investigation costs and govern communications between seller, buyer, aggregator, insurer and advisers.

The OAIC’s current breach guide describes four broad steps: contain, assess, notify if required, and review. It says entities covered by the Notifiable Data Breaches scheme must assess suspected eligible breaches and, where required, notify affected individuals and the OAIC (OAIC — Quick reference guide for responding to data breaches). The parties should obtain prompt specialist advice on whether an incident meets the statutory tests and which entity leads each response.

A buyer’s decision record

Before approving migration, require a short signed-off schedule showing:

  • transaction structure and relevant entities;
  • datasets and systems in scope;
  • legal basis and approvals for every access stage;
  • data-room users, controls and access log;
  • migration, retention, return and deletion responsibilities;
  • client communication owner, wording, timing and exception process; and
  • breach contacts, insurance notification steps and stop-work authority.

Pause if identified client files appear before the agreed gate, the seller cannot explain the source or original purpose of material fields, download access is unlogged, or no one owns post-completion correction and complaint requests. The objective is not to collect the largest possible dataset. It is to establish a controlled, supportable path from investigation to servicing.

Sources

Disclaimer

This article provides general information only. It does not constitute legal, tax, accounting, financial, credit, valuation or other professional advice. Circumstances differ. Obtain advice from appropriately qualified advisers before acting or entering a transaction.