In its common form you wouldn't be providing any information if the user is just surfing. The site get info on the user such as their IP address, browser version, etc. but that isn't NPPI or indicative that they are your customer. Unless as RL noted they know the user came from a customer only area. Still, you haven't provided much data. A static URL would be the most. I don't know that anyone has opined that it would be NPPI, but I could see that it may.
In any case, if you have a written linking agreement, protecting your customers is always a good idea.
I do recommend a pop-up or some notification that informs the user that they are leaving your site and privacy/cookie policies may differ.
My opinions are not necessarily my employers.
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell