In M&A transactions, protecting confidential information is crucial.  

Last year, we published a blog titled Privacy and Data Security Considerations in M&A Transactions (from a Seller’s Perspective), where we explored how potential buyers are scrutinising targets’ data handling practices more rigorously and the need to be cautious when uploading documents to a virtual data room.  

‍

In this blog, we are looking at the role of non-disclosure agreements (NDAs) and other practical measures that can be implemented to protect your business’s confidential information during an M&A transaction.

‍

What does an NDA cover?

NDAs in M&A transactions typically include the following key elements aimed at securing shared information:

• Definition of confidential information: This usually encompasses all financial data, intellectual property, client lists, employee information, and other sensitive details disclosed or shared between the parties in connection with the transaction.
• Obligations of the recipient: NDAs specify how the recipient (often the prospective buyer) must handle this information.  Common obligations include:
  
  • Non-Disclosure: Prohibits the sharing information with third parties except as explicitly permitted by the NDA.
  • Permitted Use: Limits the recipient’s use of the information strictly to evaluating the transaction, barring any competitive or unrelated business use.
• Disclosure to representatives: Permits the recipient to share information with specific third party representatives (e.g., legal or financial advisors) who need access to facilitate the transaction.  Such access may be conditional.
• Return or destruction of information: Requires the recipient to return or destroy confidential materials if the transaction does not proceed, helping to prevent post-negotiation misuse.
• Term:  An acknowledgement that the obligations of confidentiality will continue for a certain agreed period and, in some cases, beyond termination of the NDA.

NDAs for M&A transactions also often include a non-solicitation provision, an acknowledgement that injunctive relief may be sought to stop a breach of the agreement, an acknowledgement that no representations or warranties are made in relation to the accuracy or quality of the information provided and provisions that make it clear that neither party is obligated to enter into or complete any transaction unless further transaction documents are agreed.  

‍

Limitations of NDAs in M&A Transactions

While NDAs are an important tool for protecting confidential information, they have certain limitations:

• Third-party risks: NDAs only bind the parties directly involved in the agreement.  While an NDA should also ensure that a party is liable for unauthorised disclosures made by that party’s advisors and consultants, those advisors and consultants may not feel the same obligation to keep confidential information secure if they do not have a direct contractual obligation to do so.  
• Residual information risk: NDAs generally include provisions for the return or destruction of materials, but information may still remain in the recipient's systems, internal notes or in their general knowledge.  Once exposed, business-critical insights such as customer data, pricing strategies, or intellectual property may be difficult to fully contain.
• Damages:  Damages awarded by a court for breach of an NDA may not cover the true cost to a business of having its confidential information disclosed.  

‍

Additional Protective Measures to Safeguard Information

In addition to a well-drafted NDA, sellers should implement additional safeguards to address confidentiality and privacy concerns in M&A transactions, such as:

• Online data rooms: Use secure online data rooms to control document access, use (including ability to download) and track activity.  This approach aligns with privacy best practices, particularly for managing personal data securely during due diligence.  
• Limit access on a need-to-know basis:  Only allow access to a limited number of persons who have a need to access that information.  Each party should nominate which employees and other advisors that have a reasonable need to access the confidential information.
• Marking documents:  Clearly marking documents as confidential puts the recipient on notice that it is confidential.
• Staged due diligence, anonymisation and redactions: Carefully consider the information that is disclosed to determine whether it is necessary for the relevant transaction and whether it would be appropriate to implement further controls on that information.  For example:  
  
  • particularly sensitive information could be included in a ‘black box’ that is only provided if certain milestones are met and to certain key individuals (rather than the whole of the M&A team).  
  • It might be appropriate to redact and/or aggregate certain personal and sensitive information.  
• Other access restrictions: Limit who can access sensitive information, using multi-factor authentication and other access controls (such as encryption) tailored for transaction-specific information.
• Communication:  Regularly remind persons who have access to the confidential information of their obligations and ensure they understand those obligations extend after the transaction concludes.

‍

Conclusion
NDAs provide a foundation for confidentiality in M&A transactions, but should be used alongside other privacy and data security practices to offer stronger protection for your business.  

Contact the team at Sierra Legal today to explore how we can support you with your M&A activity.

‍