Asset purchase retained data copies: who keeps which records

How should an asset purchase define who retains which business records?

An asset purchase should define record retention family by family in the purchase agreement: who receives the original, whether the other side may keep a copy, what that copy may be used for, who can demand access later, and when and how any copy is destroyed. A record that is not assigned anywhere ends up in whatever system it happened to sit in, which is how disputes start.

In an asset deal only the assets listed in the agreement transfer, so records follow the business they belong to unless the agreement says otherwise. Sellers usually keep records tied to excluded assets and retained liabilities, such as tax returns and payroll, and buyers usually take the customer and operating records of the business they bought. The hard questions are about copies: the seller still needs some transferred records to file taxes or defend claims, and the buyer may need some of the seller's retained records to run the business.

This article gives a copy custody and rights issues map that deal teams and counsel can fill in, the seller-side retention needs that drive retained copies, how privacy promises travel, how to handle copies no one listed, an illustrative example and an exception. It is general information, not legal advice; qualified counsel reviews the specific agreement and facts.

Original, copy, access or right: which one is the schedule granting?

Every line in a records schedule grants one of four different things, and most drafting problems come from treating them as one. Settle which of the four each line grants before arguing about who gets what.

Custody of an original is not the same as owning the information in it; owning it is not the same as having privacy permission to reuse the personal data inside it; and none of those is the same as a contractual right to license it to someone else. A retained copy, in particular, is usually a custody grant with a narrow use right attached, not a second ownership interest.

Copy custody and rights issues map for an asset purchase

The map below is the asset. Each row is a record family; each column is a decision the agreement should make explicit. The entries show a typical starting position for a U.S. asset deal and the issue counsel should resolve; they are not a substitute for the deal's own facts and should be marked up by counsel for every transaction.

Fill one row per record family and system, not per department. Customer records held in a CRM, a billing platform and a shared drive are three rows, because each system has its own access controls, backups and exit path.

Which records does the seller still need after closing, and for how long?

The seller usually still needs tax, employment and dispute records for years after closing, which is the main reason retained copies exist. The retention periods come from law and from the seller's exposure, not from the buyer's preferences.

For tax, the IRS says records relating to property should generally be kept until the period of limitations expires for the year in which the property is disposed of, which matters because the asset sale itself is that disposition. The IRS also tells employers to keep employment tax records for at least four years after the tax becomes due or is paid, whichever is later. Under the Fair Labor Standards Act regulations, payroll records must be preserved for at least three years, and supplementary records such as time cards and wage rate tables for at least two years. State law, industry rules and any litigation hold can extend these periods.

Turn those duties into the retained-copy clause. List the record families the seller keeps or copies for each purpose, the period, who may access the copy, and that the copy may not be used to compete with the buyer or for any purpose not listed. Where the buyer holds originals the seller will need, such as job files behind a warranty claim the seller kept, add a post-closing access clause instead of a copy.

Do privacy promises follow the transferred records and the retained copies?

Yes. Privacy promises made when information was collected generally travel with it, both to the buyer that takes the original and to any party that keeps a copy. A change of ownership does not reset what customers were told.

California's consumer privacy law, for example, excludes from the definition of a sale a transfer of personal information as an asset that is part of a merger, acquisition or similar transaction in which the third party assumes control of all or part of the business, but only if the information is used or shared consistently with that law. FTC staff told Facebook and WhatsApp in 2014 that WhatsApp's privacy promises had to be honored after the acquisition and that material changes to the use of data already collected required affirmative consent. In February 2024 the FTC's Office of Technology added that adopting more permissive practices, such as using data for AI training, and disclosing that only through a retroactive policy change could be unfair or deceptive.

For the map, that means each row needs a note on what the relevant privacy notices and customer contracts said at collection. A retained copy inherits those limits too: a seller keeping customer records for tax support cannot treat them as fresh material for a new purpose.

What happens to copies nobody listed: mailboxes, backups and shared tenants?

Copies nobody listed still exist, and they are where most post-closing surprises come from. Name them in the agreement and give each one an owner and an end state: transfer, segregate, or destroy with evidence.

Common unlisted copies include shared mailboxes that mixed sold and retained lines, laptops of employees who did not transfer, SaaS tenants the buyer will use under a transition services agreement, exports sitting in personal cloud storage, data warehouse extracts, and backups that will keep rotating for months. Each needs a line in the closing checklist with the system, the owner and the date the action is due.

When the agreement requires destruction, specify the method and the evidence. NIST's media sanitization guideline, revised in September 2025 as SP 800-88 Rev. 2, describes clear, purge and destroy as sanitization methods; asking for a written certificate that names the systems, the method and the date gives both sides a record. For backups that cannot be selectively purged, agree on segregation and access restrictions until the backup ages out, rather than a promise of destruction that cannot be kept.

Illustrative example: a regional services seller divides its records

The example is fictional. A regional company sells its residential service division to a buyer and keeps its commercial division. Both divisions used one CRM, one billing platform, one shared drive and one email domain for eight years.

Working through the map, the deal team splits the CRM by account type and transfers residential accounts and job history to the buyer's tenant. The seller keeps a read-only copy of residential invoices and job tickets for the tax limitation period and for warranty claims it retained, with a clause barring any other use. Payroll for residential technicians who did not join the buyer stays with the seller; files for technicians who joined move with their consent where required. Shared drive folders are tagged by division and copied, with a joint list of folders nobody could classify sent to counsel. Mailboxes of transferring staff are exported, and the seller's backups are segregated until they rotate out, with a certificate when they do.

The step the team almost missed was data already shared outside the company: a scheduling vendor held residential job history under a contract that was not assigned. The final map added that row, with the vendor's copy covered by a notice and deletion request after the transition period.

The exception: a retained copy that cannot be licensed or reused

A retained copy that was negotiated for tax support, claims defense or regulatory retention usually cannot be licensed, sold or used for AI training, even after it has been de-identified. The copy was granted for listed purposes, and the privacy notices and customer contracts behind it still apply.

This catches sellers who later discover that their historical records have licensing value. If the seller wants the right to license de-identified information from records it is transferring, that right has to be negotiated before signing, stated expressly in the purchase agreement, and checked against what customers were told. The buyer faces the mirror problem: records it acquired come with the seller's earlier promises, and with any restrictions in contracts it assumed.

De-identification reduces privacy exposure but does not create a right to license. A retained-copy clause that says nothing about secondary use should be read as not granting it, and both sides are better served by saying so explicitly.

Which facts should send the map back to counsel before signing?

Some facts make a standard retained-copy approach unsafe, and the map should go back to counsel when any of them appear. Treat these as stop points, not as items to resolve during integration.

• 1A record family contains health, financial account, biometric, children's or other sensitive personal data, or data subject to sector rules.
• 2Privacy notices changed during the period the records cover, so different records carry different promises.
• 3Customer or vendor contracts restrict assignment, copying or disclosure, or require consent the parties have not obtained.
• 4Records relate to pending or threatened litigation, an audit or a government inquiry, which may require a hold on both sides.
• 5The seller is dissolving after closing, so a custodian for its retained records must be named before it loses the people who know them.
• 6Either party plans a new use of the records, such as analytics for third parties, AI training or licensing.
• 7Records are held by a third party under a contract that is not being assigned.
• 8Some records sit outside the United States or concern people in other jurisdictions with their own transfer rules.

If either side later wants to license the records

If either party may want to license records to AI developers later, decide it in the purchase agreement, because afterward the retained-copy clause and the privacy history will usually rule it out. A completed map is also the evidence a later rights review asks for: which entity holds each original, under what notices, with which copies outstanding.

A party that holds records after a deal and wants to license them can turn to SourceX for the rights review, contracting and preparation. In that process the company approves the scope and terms and signs the agreement before any data is delivered, so a seller's retained copy or a buyer's acquired records would be reviewed against the purchase agreement first. A seller weighing that option can begin with SourceX's short company assessment, which needs no records.