Buying an Online Business: Key Legal Checks, Contracts and Risks

Buying an established online business can feel like a shortcut to growth. Instead of starting from scratch, you’re acquiring a website, customer base, revenue streams, supplier relationships and (hopefully) a brand that already has momentum.

But when you’re buying an online business, you’re also inheriting risk. The tricky part is that many of those risks don’t show up in a quick screen-share of a Stripe dashboard or a handful of tidy spreadsheets.

This guide walks you through the legal checks, the key contracts and the common deal structures UK SMEs and startups should think about when buying an online business through an asset or share deal - so you can buy with your eyes open and protect your business from day one.

Why Buying An Online Business Can Be A Smart Move (And Why The Legal Side Matters)

There are plenty of good reasons for buying online businesses:

• Proven demand (traffic, conversion rate, repeat customers)
• Existing supplier relationships and operational processes
• Brand presence (SEO rankings, email list, social audience)
• Revenue on day one (rather than waiting months to validate)

That said, online businesses are often “lightweight” in the wrong ways. They may not have formal contracts, the IP might not be properly owned by the seller, or the business may have grown quickly without keeping up with compliance.

So when you’re buying a business online, your goal is simple:

Confirm what you’re actually buying, confirm it can be transferred to you, and confirm you’re not taking on unknown liabilities.

This is where legal due diligence (and the right purchase documents) makes the difference between a clean acquisition and a costly surprise.

Asset Purchase Vs Share Purchase: What Are You Actually Buying?

One of the first decisions when buying an online business is the deal structure. In the UK, you’ll usually see one of these:

1) Asset Purchase (Buying The Business Assets)

With an asset purchase, you buy selected assets of the online business, for example:

• domain names and websites
• brand assets (logos, content, product photography)
• customer databases and email lists (subject to data protection rules)
• stock and equipment (if any)
• contracts (supplier agreements, licences - if assignable)
• social media accounts and marketing assets (where transfer is permitted)

Why buyers often like asset purchases: you can “pick and choose” what comes across, and you may be able to leave behind certain liabilities.

Common catch: you need to ensure each asset can actually be transferred (for example, some platform accounts or software subscriptions don’t allow transfer, and some contracts require consent).

2) Share Purchase (Buying The Company)

With a share purchase, you buy the shares in the company that owns the online business. The company stays the same; you step into ownership.

Why sellers often prefer share purchases: it can be cleaner for them (they sell the company and walk away) and it may be more tax-efficient in some cases (you should take tailored tax advice on your deal).

Key buyer risk: when you buy the company, you buy everything in it - including historic liabilities (known and unknown). This makes due diligence and warranties absolutely critical.

In practice, the “right” approach depends on what you’re buying (ecommerce store, SaaS, content site), how it’s set up, and what risks you’re prepared to accept. This is also where it’s worth getting a lawyer involved early - changing the structure later can be messy and expensive.

Key Legal Due Diligence Checks When Buying Online Businesses

Due diligence is the process of verifying the business before you commit. Think of it as: trust, but verify.

Below is a practical checklist of legal checks to run when buying an online business in the UK.

Business Structure And Ownership

• Who owns the business? Is it a sole trader, partnership, or limited company?
• If it’s a limited company, confirm the registered details on Companies House and whether there are multiple shareholders.
• Confirm authority to sell (board/shareholder approvals may be needed).
• Check for charges (security registered against the company that could affect the assets).

If you’re doing a share deal, you’ll also want clarity on what happens post-sale if there are remaining shareholders or investors. That’s often managed via a Shareholders Agreement (even if it’s just you and one co-founder after completion).

Intellectual Property (IP): Website, Brand, Content And Code

For many online businesses, the IP is the business.

You’ll want to confirm:

• Who built the website? If it was a freelancer or agency, do you have a written assignment of IP rights?
• Who owns the code? Especially important for SaaS or custom software.
• Brand assets: logos, designs, product packaging, templates.
• Content rights: blog posts, product photos, videos, graphics, courses.
• Trade marks: are any registered, and are they owned by the seller/company?

If key IP wasn’t properly assigned to the seller in the first place, you may not be acquiring it - even if the seller “paid for it”. This is a classic hidden risk in online business acquisition deals.

Contracts And “Transferability” (A Big One For Online Businesses)

Online businesses often rely on a web of third-party relationships, such as:

• suppliers and manufacturers
• software subscriptions and hosting
• affiliate relationships
• freelancers/contractors (marketing, development, customer support)
• commercial leases or storage agreements (if there’s inventory)

Key question: can these contracts be transferred to you?

Some contracts allow assignment; others require the other party’s consent; and some prohibit transfer entirely. If a contract can’t be transferred, you may need a replacement arrangement or a formal contract transition process (sometimes documented with a deed).

Where you need to document a change of contracting party, a Deed of Novation is often the cleanest method (because it replaces a party to the agreement, rather than merely assigning rights).

Customer Terms, Refund Risk And Consumer Law Compliance

If the business sells to consumers (B2C), you’re stepping into a heavily regulated area - even if the seller hasn’t treated it that way.

At a minimum, check:

• What terms customers agree to (and whether they’re actually enforceable)
• Refund, returns and delivery policies
• Whether the business follows the Consumer Rights Act 2015 (quality, refunds, services performed with reasonable care and skill)
• Whether the website and checkout process comply with the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 for distance selling (including required pre-contract information and cancellation rights where they apply)
• Whether marketing claims could breach unfair trading rules (for example, misleading pricing or performance claims)

If you’ll keep trading under the same model, it’s often worth updating the website terms at completion so you’re not inheriting non-compliant wording. Many online businesses rely on a basic terms page that doesn’t match how they actually operate - and that can become a dispute quickly when a customer complains.

Depending on what you sell (goods/services/subscriptions), properly drafted E-commerce Terms and Conditions can be a key part of your “post-acquisition clean-up”.

Data Protection: Email Lists, Customer Databases And GDPR Risk

When buying an online business, people often focus on revenue and traffic - but the database is usually part of the value (email list, customer history, behavioural analytics).

In the UK, transferring personal data has to be done lawfully under the UK GDPR and the Data Protection Act 2018. Practical checks include:

• What personal data is held (customers, subscribers, suppliers, contractors)
• How it was collected and what privacy information was given at the time
• What lawful basis the business relies on for its processing (consent isn’t always required, but it must be clear and documented)
• Whether the business has a compliant privacy notice and cookie practices
• Whether marketing emails comply with PECR rules (for example, consent may be required in many cases, but the “soft opt-in” may apply for existing customers if the conditions are met, and unsubscribe mechanisms must be in place)
• Whether there have been data breaches or complaints

A good starting point is making sure the business has a fit-for-purpose Privacy Policy and that it reflects the reality of the business (what tools are used, what data is collected, and what it’s used for).

If you’re buying a SaaS or tech-enabled online business that processes customer data on behalf of business clients, check whether a Data processing schedule is in place (or needs to be implemented) - it’s a common contractual requirement for B2B customers and a practical GDPR safeguard.

Financial, Tax And Operational Red Flags (That Often Have Legal Consequences)

While your accountant will lead a lot of the financial review, it’s worth understanding how money issues and legal risk connect. Look out for:

• Chargebacks and refund rates (could indicate product quality issues or misleading marketing)
• Supplier disputes or unpaid invoices
• Undeclared liabilities (warranties to customers, store credit, prepaid subscriptions)
• VAT registration status and whether VAT has been treated correctly (especially for digital services or cross-border sales)
• Reliance on one traffic source (if revenue depends on one channel, the purchase agreement should address this risk through disclosures and warranties)

These aren’t just “business” issues - they affect what protections you need in the sale contract and whether the price/structure is right.

What Contracts And Documents Do You Need When Buying An Online Business?

Once you’ve decided to proceed (subject to due diligence), the acquisition needs to be documented properly. Handshake deals and short email chains are where misunderstandings happen - especially when you’re buying an online business with intangible assets.

Here are the key documents SMEs and startups commonly need.

1) Heads Of Terms (Or A Term Sheet)

This sets out the commercial deal points before the long-form contract is drafted. It usually covers:

• price and payment terms (including earn-outs or deferred payments)
• what is being sold (assets vs shares)
• exclusivity period
• key conditions (eg finance, due diligence, third-party consents)
• confidentiality

Even if it’s stated to be “non-binding”, some parts (like exclusivity and confidentiality) are often intended to be binding - so it’s worth getting it checked before you sign.

2) The Main Sale Agreement

This is the core contract. Depending on structure, it could be a business sale agreement (assets) or a share purchase agreement (shares).

For share deals, a Share Sale Agreement typically sets out:

• the shares being sold and price
• completion mechanics (when ownership transfers)
• warranties and disclosures
• limitations on the seller’s liability
• post-completion obligations
• restraints (where appropriate) to stop the seller immediately competing or poaching

For asset deals, your agreement needs to clearly list the assets, how they’re transferred, and what liabilities (if any) you’re taking on.

If you’re not sure what “market standard” looks like for warranties, limitations, earn-outs and security, getting a lawyer to run a Contract Review can save you from signing something that looks normal but leaves you exposed.

3) IP Assignment And Domain Transfer Documents

Don’t assume that “access to the Google Drive folder” equals ownership.

You may need:

• a formal assignment of copyright in website content, designs and code
• trade mark assignment (if a registered mark is included)
• domain transfer steps with the registrar
• hand-over of key accounts (subject to platform rules)

This is particularly important if the seller used contractors historically. Without assignments, a contractor could technically retain IP rights, which is the last thing you want after paying for the business.

4) Transition Services And Handover Arrangements

Many online businesses depend on founder knowledge: suppliers, fulfilment workarounds, customer service templates, ad account structure, SEO strategy, and so on.

Consider documenting:

• a handover period (eg 2–8 weeks)
• training/support hours included
• introductions to suppliers and key partners
• service levels (response times, scope of support)

This can be built into the sale agreement, or set out as a separate services arrangement. The goal is to avoid “deal done, seller disappears” syndrome.

5) Confidentiality And Non-Compete Protections (Where Appropriate)

You may want contractual protection so the seller doesn’t immediately launch a near-identical site and target the same audience.

These restrictions need to be reasonable and tailored (scope, geography, time period). Overreaching restraints can be difficult to enforce, so it’s worth drafting them carefully and proportionately to the deal.

Post-Completion Risks To Plan For (So You Don’t Inherit A Mess)

Even with strong due diligence, there are a few “classic” risks that come up after buying online business assets or shares. Planning for them early helps you avoid disruption.

Platform And Account Transfer Problems

Some accounts can’t be transferred cleanly, or transferring them triggers reviews/suspensions (for example, certain ad accounts, payment accounts, app store listings, or marketplace seller profiles).

Practical steps:

• Identify which platforms are mission-critical and confirm their transfer rules early.
• Build a completion checklist that includes a staged handover (rather than switching everything in one day).
• Consider escrow or deferred payment tied to successful transfer of core accounts.

Consumer Complaints And Legacy Refund Requests

Customers don’t care that there’s been a sale - they just want a refund, a replacement or support.

Make sure the sale agreement covers:

• who is responsible for pre-completion refunds/chargebacks
• how customer complaints are handled during transition
• what happens with outstanding store credit, gift cards, or subscriptions

Data And Marketing Compliance Catch-Up

After completion, it’s a good time to “clean house” on compliance:

• update privacy notices and cookie banners to reflect your tools and purposes
• confirm the lawful basis and PECR position for the email list (including whether “soft opt-in” applies) before sending campaigns
• review customer-facing terms so they match the operational reality
• ensure you have contracts with key suppliers/contractors going forward

This isn’t about perfection - it’s about reducing your exposure and making the business easier to scale and invest in.

Key Takeaways

• Buying an online business can accelerate growth, but only if you confirm the assets, accounts and rights can actually be transferred to you.
• Decide early whether you’re doing an asset purchase or a share purchase - it changes what you inherit and what protections you need.
• Run focused legal due diligence on IP ownership, key contracts, customer terms, distance-selling requirements under the Consumer Contracts Regulations 2013, and UK GDPR/PECR compliance (especially if an email list is part of the value).
• Use the right sale documents, with clear warranties, limitations of liability, and a practical handover plan, rather than relying on informal emails.
• Plan for post-completion realities like platform transfer issues, legacy refunds, and a compliance refresh for terms and privacy documents.
• If anything feels unclear, get advice early - it’s much easier (and cheaper) to fix issues before you complete than after you’ve paid.

If you’d like help with buying an online business - from due diligence through to negotiating and drafting the sale documents - you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.