Buying an Online Business in the UK: Legal Checklist

Buying an online business can be a smart shortcut to growth-you get customers, brand, and systems on day one without starting from scratch.

But don’t let the speed tempt you into skipping the legals. The way you structure the deal, what you check before you buy, and the documents you put in place afterwards will make a huge difference to whether the business performs as you expect.

In this guide, we’ll walk through how buying an online business works in the UK, the key legal decisions, and a practical checklist to help you buy with confidence.

Should You Buy An Online Business? Pros And Pitfalls

An established online business can give you immediate revenue, supplier relationships, and proof that the product-market fit already exists. That’s a huge advantage compared to starting from zero.

However, acquisitions also come with risks. In the online space, these often include inflated traffic or revenue numbers, overreliance on a single marketing channel, unowned IP (like images, code, or brand assets), or compliance gaps around consumer law and data protection.

Before you go too far, sense-check the opportunity with a balanced view:

• Proven demand and cash flow vs future sustainability (is revenue recurring or one-off?)
• Brand goodwill vs risk of negative reviews or reputational baggage
• Supplier and platform dependencies (Amazon/eBay/Shopify/Meta/Google) vs your ability to diversify
• Operational maturity vs key-person risk (is the founder the linchpin?)
• Compliance posture (consumer, privacy, cookies, advertising) vs remediation cost and timing

If the upside looks compelling, the next decision is how to structure the purchase.

Asset Purchase Vs Share Purchase: How To Structure The Deal

Most UK acquisitions of small online businesses use either an asset purchase or a share purchase. The “right” choice depends on what you want to acquire-and the liabilities you’re willing to take on.

Asset Purchase (Business And Assets)

Under an asset purchase, your buyer entity acquires specific assets (for example, the domain name, website, code, brand, stock, customer contracts, and social accounts). You generally don’t inherit historic liabilities unless you expressly agree to assume them.

Pros:

• Cleaner transfer with more control over what you buy and what you leave behind
• Lower risk of unknown liabilities (tax, litigation, contracts you don’t want)
• Potentially simpler for very small deals

Cons:

• Some contracts and platform accounts may not be transferable or may require consent
• Employees may transfer automatically under TUPE (more below)
• May trigger VAT or stamp duty issues depending on assets and structure

The acquisition agreement for an asset deal is usually a Business Sale Agreement, which sets out the assets you’re buying, price, completion mechanics, warranties, and post-completion obligations.

Share Purchase (Company Shares)

In a share deal, you acquire the shares in the company that owns and operates the online business. You step into the owner’s shoes-taking the company “as is”, including its assets, contracts, employees, and liabilities.

Pros:

• Smoother continuity of operations (contracts and platform accounts stay with the company)
• Potentially simpler to execute if there are many third-party consents needed in an asset sale
• Potential tax advantages for the seller (which can help price negotiations)

Cons:

• You inherit historic liabilities (tax, disputes, compliance breaches)
• Due diligence needs to be deeper and warranties more comprehensive
• More complex post-completion integration and governance

The main contract in a share deal is a Share Sale Agreement, typically with a detailed disclosure letter and tax covenants.

Which route should you take? As a rule of thumb, asset purchases often suit smaller acquisitions focused on digital assets and brand, while share purchases can work well where continuity is critical and the company’s risk profile is well-understood. Either way, get tailored advice-small details (like a single non-transferable platform account) can swing the decision.

Legal Due Diligence: What To Check Before You Commit

Due diligence is where you verify that what you think you’re buying is actually what you’ll get. For online businesses, go beyond the financials-probe traffic, IP ownership, data practices, and the tech stack. A structured approach helps you avoid expensive surprises.

1) Corporate And Commercial

• Legal status: company filings at Companies House, group structure, and ownership
• Material contracts: suppliers, platforms/marketplaces, logistics, payment processors, affiliates
• Change-of-control/assignment: check if key contracts can be transferred or require consent
• Disputes: threatened or ongoing litigation, ASA complaints, take-downs, or IP claims

2) Financial And Tax

• Revenue quality: channel/repeat vs one-off, refund and chargeback rates
• Tax compliance: VAT registration and returns, PAYE, corporation tax, any HMRC enquiries
• Working capital and stock: slow-moving or obsolete inventory; liabilities and accruals

3) Intellectual Property

• Trade marks: brand name and logo-registered or only unregistered rights?
• Digital assets: domain names, websites, apps, code repositories, social handles (ownership evidence)
• Copyright: product imagery, product descriptions, blogs; licensed vs owned content
• Assignments: confirm contractors or agencies assigned IP to the business

If protection gaps exist, consider applying to register a trade mark as part of your post-completion plan (or condition the deal on filing first).

4) Data Protection And Privacy

• Lawful basis and consents: how the business collects and uses personal data, cookie consent records
• Privacy notices and internal policies: are they compliant with UK GDPR/Data Protection Act 2018?
• Processor contracts: DPAs with email, CRM, analytics, and fulfilment providers
• Data map: where customer and subscriber data is stored, retention periods, and deletion processes

Where data is a key asset, require robust warranties and ensure the target has (or will implement) a compliant Privacy Policy and, with vendors, an appropriate Data Processing Agreement.

5) Employment And TUPE

• Staff list: roles, pay, benefits, and seniority; identify key personnel
• Contracts and policies: up-to-date terms, restrictive covenants, and IP/confidentiality clauses
• TUPE: in asset purchases, employees may transfer automatically on their existing terms
• Contractors: check IR35 risks and whether IP was properly assigned

Plan for immediate onboarding with clear documentation-if you’ll be their new employer, you’ll need the right Employment Contract suite ready to go.

6) Consumer, Advertising And Platform Risk

• Refunds and returns: compliance with the Consumer Rights Act 2015 and the Consumer Contracts Regulations 2013
• Claims and promotions: compliance with ASA/CAP Code and the CMA’s guidance on reviews and endorsements
• Platform policies: Amazon/Shopify/eBay/Meta/Google policy history, warnings, or suspensions
• Website compliance: clear pricing, delivery info, cancellation terms, and cookie consent

If you prefer a structured process, engaging a lawyer to run a scoped Legal Due Diligence review can save time and highlight red flags early, before you’re locked in.

Key Laws Online Businesses Must Follow In The UK

Once you own the business, compliance is on you. Here are the core legal areas every UK online business needs to get right from day one.

Consumer Law (Sales, Refunds And Transparency)

The Consumer Rights Act 2015 sets quality standards for goods and services and gives customers clear refund and repair rights. For distance sales, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 require upfront disclosures (like who you are, key product information, total price, delivery costs) and a 14-day cooling-off period for many consumer purchases.

Practically, this means your website needs accurate product descriptions, fair terms, and a transparent returns policy. Hidden fees or unfair terms risk CMA action and chargebacks.

Privacy And Cookies (UK GDPR)

If the business collects personal data (customer accounts, newsletter subscribers, analytics), you must comply with the UK GDPR and Data Protection Act 2018. You’ll need a lawful basis for processing, a compliant privacy notice, appropriate processor contracts, and security measures. For cookies and similar tech, PECR requires consent for non-essential cookies-don’t preload marketing tags without opt-in.

At minimum, publish and maintain a compliant Privacy Policy and keep your cookie banner honest about what’s loaded and when.

eCommerce Disclosures And Emails

The Electronic Commerce (EC Directive) Regulations 2002 require clear identity information on your site (company name, geographic address, email, company registration number, VAT number if applicable) and transparent pricing. For marketing emails, ensure consent or a valid “soft opt-in” and provide an unsubscribe link in line with PECR and the ICO’s guidance.

Company And Tax

If you acquire shares, corporate governance continues under the Companies Act 2006-maintain registers, file accounts, and keep PSC information up to date. Whether asset or share deal, check VAT registration thresholds, update HMRC, and handle PAYE for any staff. If you’re reorganising after purchase, plan this with your accountant to avoid accidental tax costs.

Employment And TUPE

In an asset sale, TUPE (Transfer of Undertakings (Protection of Employment) Regulations 2006) can move employees to you automatically on their existing terms. You’ll need to inform and, in some cases, consult affected employees. Don’t change terms without proper process-get advice first and put in place updated documentation, including each relevant Employment Contract.

Essential Contracts And Documents After Buying

Your post-completion checklist should lock down ownership, tidy compliance, and align operations to your plans. Here’s what to prioritise.

Acquisition Contracts And Assignments

• Transfer documents: assignment of domain, IP, social media, code repositories, and any supplier/customer contracts agreed to transfer
• Escrow/earn-out mechanics: ensure KPIs and reporting are clearly defined and enforceable
• Restrictive covenants: keep sellers from competing or poaching staff for an agreed period

Customer-Facing Terms

• Website and store terms: set clear rights and obligations and align with consumer law-use robust Online Shop Terms and Conditions and site terms
• Privacy and cookies: refresh your Privacy Policy and cookie wording to match actual data practices and tools
• Subscription/auto-renew: add fair, transparent renewal and cancellation terms if you run subscriptions

Supply Chain And Operations

• Supplier and fulfilment: update or renegotiate agreements; check SLAs, liability caps, and termination rights
• Marketing partners: ensure influencer and affiliate terms include ASA/CAP-compliant disclosure obligations
• Technology stack: confirm licences and ownership for themes, plugins, custom code, and integrations

Brand And IP

• Trade marks: file for protection as needed and record any assignments; plan for international filings if you sell abroad
• Content: ensure photographer/creator agreements include IP assignment or a suitable licence
• Housekeeping: consolidate brand guidelines and update copyright notices

If you’re acquiring only part of a company or taking on an investor, align governance with a tailored Shareholders Agreement so rights, exits, and decision-making are crystal clear.

People And Policies

• Employment documentation: issue updated Employment Contracts, IP/confidentiality clauses, and update your staff handbook
• Freelancers/contractors: put in place clear contractor terms with IP assignment and confidentiality
• Data and security: implement access controls, incident response plans, and regular training

Governance And Risk

• Insurance: review cyber, product, and business interruption cover
• Limits of liability: ensure your commercial contracts cap your risk proportionately
• Compliance calendar: diarise ICO fee, Companies House filings, VAT returns, and policy reviews

Negotiation Tip: Use Warranties And Price To Manage Risk

If due diligence reveals issues (say, patchy consents for email lists or missing IP assignments), you have options:

• Fix pre-completion (seller obtains consents, files trade marks, signs assignments)
• Price adjustment or escrow (hold back part of the price until issues are cured)
• Specific indemnities (seller covers defined risks if they materialise)

The right mix protects you without killing the deal. A well-drafted Business Sale Agreement or Share Sale Agreement is where these protections live-avoid generic templates, as they rarely fit the realities of online operations.

Key Takeaways

• Decide early whether an asset purchase or share purchase best fits your goals-asset deals give cleaner control of what you buy; share deals preserve continuity but transfer liabilities.
• Run targeted due diligence on IP ownership, data protection, platform dependencies, consumer law compliance, and TUPE-don’t rely on topline revenue alone.
• Build your risk protection into the contract with warranties, indemnities, price adjustments, and clear completion deliverables; use a tailored Legal Due Diligence process to surface issues early.
• Post-acquisition, lock down brand and data with trade marks, a compliant Privacy Policy, and robust Online Shop Terms and Conditions that reflect UK consumer law.
• Prepare people and processes from day one: issue updated Employment Contracts, refresh supplier terms, and align governance with a clear Shareholders Agreement if you have co-owners.
• Treat compliance as an enabler of growth-getting these legal foundations right protects value and makes your newly purchased online business more resilient as it scales.

If you’re considering buying an online business and want help structuring the deal, running due diligence, or drafting the right documents, we’re here to help. You can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.