Confidentiality Controls in M&A: Buyer Outreach, Data Rooms and GDPR

Short answer: Confidentiality in an acquisition is a sequence of controls, not a single NDA. The seller releases information in stages (anonymous teaser, NDA, CIM, data room, then the most sensitive items late and to named people), and each stage has its own technical control: who can see a file, whether they can download it, and a log of who opened what. For a technology company or a deal that crosses borders, add two more layers: personal data handled under GDPR from the first file shared, and a clear record of where the documents are stored and who processes them.

This guide is written for founders preparing to sell, buyers running a process, and the small deal teams around them. It is practical, not legal advice. For anything that turns on a specific law or contract, ask your lawyer.

Why confidentiality fails in small deals

Most leaks in small and lower-middle-market deals are not attacks. They are ordinary process failures:

• A teaser that is "anonymous" but describes the only company of its size in a city.
• A full data room opened to every party that signed an NDA, including competitors who are fishing.
• Customer contracts and employee files shared early, before the buyer has shown real intent.
• A spreadsheet emailed outside the data room "just this once", then forwarded.
• Former bidders who still have access weeks after they dropped out.

None of these needs sophisticated software to fix. They need a plan for what is released, to whom, and when, and a tool that enforces the plan and keeps a record.

Staged disclosure: release information as the buyer earns it

The most useful single control is staging. Each step gives the buyer more, and each step is gated by something the buyer has done.

If you are new to the documents in stages 2 and 3, start with what a CIM is and how to write a letter of intent. The diligence request list that drives stages 3 and 4 is in our M&A due diligence checklist.

Buyer outreach for a technology company

Selling a software or data business adds risks a services business does not have. Competitors are often the most motivated buyers, and some of what is in the data room (pricing, architecture, customer lists, roadmap) is valuable to them whether or not they buy.

Controls that work in outreach:

• Screen before the NDA. Ask each potential buyer who they are, how they would fund the deal and why they are interested. A strategic buyer who competes directly with the company can still be a serious buyer, but they should not be on the same access track as a financial buyer.
• Write the NDA for the actual risk. Standard points include a non-solicitation clause for staff and customers, a clear list of what counts as confidential, return or destruction of materials when talks end, and a rule that the buyer may not contact employees, customers or suppliers without permission.
• Use a clean team for competitors. Competitively sensitive data (customer-level pricing, margins by account, detailed roadmap) goes only to a small named group, often outside advisers, who report conclusions rather than raw data. Competition law can restrict what competitors may exchange before closing, so involve counsel before you share this category.
• Delay the crown jewels. Source code, security test reports and customer identities usually belong in stage 4. A buyer can assess most of the technology from architecture documents and interviews first. Our technology due diligence checklist lists what a buyer needs at each depth.

Data room security: the features that actually matter

"Enterprise-grade document security" is a phrase on every data room vendor's site. When you compare tools, ask for these specific controls and test them yourself during a trial:

1. Granular permissions. Access per folder and per user group, not just per room. You should be able to give one bidder phase 1 only and another phase 2.
2. View-only mode and download control. The ability to block download and printing for sensitive folders, while still allowing it for documents the buyer needs to work with.
3. Dynamic watermarking. Each page shows the viewer's name or email and the time. It does not stop a photograph, but it makes the source of a leak traceable and discourages it.
4. Audit log you can export. Who opened which document, when and for how long. This is evidence if there is a dispute, and it tells the seller which buyers are serious.
5. Strong sign-in. Two-factor authentication for every external user, and single sign-on for the deal team if the company uses it.
6. Fast revocation. One action that removes a bidder's access to everything, including any files they have open.
7. Expiry dates. Access that ends on a set date unless renewed, so former bidders do not linger.
8. Q&A inside the room. Questions and answers kept with the documents, instead of in email threads that leak.

No tool removes the need to decide what to share. A perfectly secure room that holds everything from day one is still a confidentiality failure.

GDPR and data residency in due diligence

A data room in a European deal almost always contains personal data: employee contracts, payroll, customer contacts, sometimes health or disciplinary records. The General Data Protection Regulation applies to that data in the deal just as it does in the business.

The points that matter most in practice:

• Minimise before you upload. Share an anonymised employee census (role, salary band, start date) in the early phases. Named records for key people can follow late, and only if the buyer needs them.
• Know who is a processor. The data room provider, and any AI tool used to read the documents, process personal data on someone's behalf. Article 28 of GDPR requires a written contract with each processor that sets out what they may do with the data.
• Know where the data goes. Transfers of personal data outside the European Economic Area need a legal basis under Chapter V of GDPR (Articles 44 to 49), such as an adequacy decision or standard contractual clauses. For US recipients, the European Commission's page on EU-US data transfers explains the current framework. Ask the data room vendor which region stores the files and backups, and which sub-processors can access them.
• Security is a legal duty, not only good practice. Article 32 asks for security appropriate to the risk. Access control, encryption and logs in the data room are part of how a seller meets it.

For a deal that spans several countries, keep a one-page register: which documents contain personal data, which country's law applies to them, where they are stored, and who has access. It takes an hour to set up and saves a long argument later. Cross-border deals have other verification problems too, covered in our piece on the verification gap in cross-border due diligence.

What an acquisition does to SOC 2 reporting

If the target company has a SOC 2 report, buyers often treat it as proof that security is solved. It is narrower than that. A SOC 2 report is an independent auditor's report on a service organisation's controls, defined by the AICPA. A Type 1 report describes controls at a point in time; a Type 2 report tests whether they operated over a period.

What to check during diligence:

• Scope. Which systems and which trust services criteria were covered. A report that covers the main product but not the data pipeline leaves the pipeline unexamined.
• Period and exceptions. When the period ended, and what exceptions the auditor found. Read the exceptions section, not only the opinion.
• What changes at closing. After an acquisition, the controls in the report may change: new owners, new identity provider, merged infrastructure, new staff with access. Customers who rely on the report will ask whether it still describes reality. Plan who owns the next audit and how integration will be documented, so the next report does not show gaps created by the deal itself.
• Bridge letters. If there is a gap between the end of the last report period and closing, the seller can provide a bridge letter stating that no material changes occurred. It is a statement by the seller, not an audit.

A confidentiality checklist you can use

• Teaser reviewed by someone outside the company: can they identify it?
• NDA covers non-solicitation, no-contact, return or destruction, and term.
• Buyer list screened, with competitors on a separate track.
• Data room folders mapped to stages, with access groups per bidder.
• Download blocked for sensitive folders; watermarking on.
• Two-factor authentication required for all external users.
• Personal data minimised; anonymised census in phase 1.
• Processor agreements in place for the data room and any AI tool.
• Storage region and sub-processors confirmed in writing.
• Access expiry dates set; dropped bidders removed the same day.
• Audit log exported and archived at closing.

Where AI tools fit, carefully

Reading a full data room is slow, and AI tools can shorten the first pass. If you use one, it becomes part of your confidentiality design. Ask where it runs, whether documents are stored or used for training, and whether it holds a processor agreement. Deal OS, our own tool for AI-assisted due diligence, reads deal documents and returns findings with a citation to the source page, so a person can check each claim. The same questions apply to it as to any other tool, and we answer them in writing. If you want a wider comparison, see our guide to due diligence software.

Frequently asked questions

Is an NDA enough to keep an acquisition confidential? No. An NDA gives you a legal remedy after a breach. It does not stop the breach. Staged disclosure, data room permissions, watermarking, download control and an audit log are what limit what a buyer can take in the first place.

When should a seller share customer names and contracts? Usually late, after a signed letter of intent and exclusivity, and only with named people at the buyer. Before that, a summary by customer size and contract length is normally enough for the buyer to judge concentration and churn.

Does GDPR apply to documents in a data room? Yes, when they contain personal data such as employee or customer records. Minimise what you share, have a processor agreement with the data room provider and any AI tool, and confirm where the data is stored and whether it leaves the European Economic Area.

What is a clean team in M&A? A small, named group, often outside advisers, who are allowed to see competitively sensitive data and report conclusions rather than raw data to the buyer. It is used when the buyer competes with the target, and counsel should set the rules.

Does a SOC 2 report still apply after the company is acquired? It describes controls for a past period. After closing, changes to owners, systems or access can make it out of date. Customers will ask, so plan the next audit and document integration changes as they happen.

What should I look for in a secure data room? Per-folder permissions, view-only mode with download control, dynamic watermarking, an exportable audit log, two-factor sign-in for every external user, fast revocation, access expiry dates and Q&A kept inside the room.