(1) The conditions in this paragraph shall apply to personal data disclosed under paragraph 1(p).
(2) In the case of disclosure to a prospective party to a business asset transaction —
(a) the personal data must be necessary for the prospective party to determine whether to proceed with the business asset transaction; and
(b) the organisation and prospective party must have entered into an agreement that requires the prospective party to use or disclose the personal data solely for purposes related to the business asset transaction.
(3) If the organisation enters into the business asset transaction, the employees, customers, directors, officers and shareholders whose personal data is disclosed shall be notified that —
(a) the business asset transaction has taken place; and
(b) the personal data about them has been disclosed to the party.
(4) In this paragraph and paragraph 1(p) —
“business asset transaction” means the purchase, sale, lease, merger or amalgamation or any other acquisition, disposal or financing of an organisation or a portion of an organisation or of any of the business or assets of an organisation other than the personal data to be disclosed under paragraph 1(p);
“party” means another organisation that enters into the business asset transaction with the organisation.