In a typical prospective sale process, a buyer will provide the seller with an extensive due diligence request list, then follow up with a multitude of supplemental requests as it examines the seller's legal, financial and operational matters. To keep the process confidential, the seller will usually rely on a small group of employees, who will need to be responsive to a buyer's requests while simultaneously trying to attend to day-to-day business operations. In all, for the seller, due diligence can be a time-consuming and stressful process.

To make this process as smooth as possible and avoid the inadvertent disclosure of sensitive information, we provide the following suggestions:

  • Ensure you have a non-disclosure agreement in place: Before you provide any information to a prospective buyer, ensure you have a non-disclosure agreement in place. It may happen that you already have an NDA in place with the prospective buyer, in the context of your existing commercial arrangements. Do not rely on that NDA. It may not provide the proper scope, may have limited life remaining or may not contain provisions that are recommended to be included in the context of a sales process.

  • Prepare for the due diligence process early: You can never start preparing too early. The due diligence process is an opportunity for you to instill confidence in the buyer in your processes and practices and the risks associated with your business and operations. For best practices early on, please see our article here.

  • Be thoughtful about the information you provide: While the seller should strive to be responsive to a buyer's requests, don’t tell the buyer everything. There are a number of considerations the seller should take into account before providing any information to a buyer.

    • Is the information competitively sensitive? The seller should be careful that it does not run afoul of antitrust regulations. Confidential information about the seller's operations, customers or sales should be evaluated to ensure a competitor is not receiving more information than is reasonably necessary for the legitimate purposes of due diligence and deal valuation.

    • Does the information include personal data? The seller will sometimes collect personal data relating to employees, customers, users and other business partners. Disclosing this data to a buyer in the due diligence process could result in violations of the seller's privacy policies and applicable data protection laws. The seller should take care to limit the disclosure of personal data such as social security numbers, driver's license numbers, credit card numbers or medical data.

    • Will disclosure cause a breach of contract? Contracts may include covenants that prohibit the parties from disclosing the terms or existence of the contract to other persons without the other party's consent. In most cases, timing and confidentiality concerns will prevent the seller from seeking consent to disclose. In these circumstances, the seller should consult with its legal advisor to decide the best approach to disclosure.

    • Is the information privileged? If the seller has materials which were prepared for the purpose of giving legal advice, those materials are privileged and would be exempt from disclosure in litigation. However, if the information is provided to a prospective buyer in the due diligence process, the seller risks losing the privilege. The seller should not provide privileged information to a prospective buyer without first consulting its legal advisor.

    • Do the materials include information about the sales process or about other prospective buyers? The seller should not produce an investment banker's engagement letter, board minutes or other materials that would provide information to the prospective buyer about other interested parties or anticipated consideration to be paid by a buyer in the sale of the company. These materials should be reviewed and redacted, as appropriate, to remove references to this sensitive information.

  • Keep track of the information you provide: The seller should keep track of the information provided to a prospective buyer in order to have a record of materials disclosed to the buyer and provide a defense against potential post-closing claims of the buyer. Online data rooms are a useful tool to securely disclose, control and track due diligence materials.

  • Don't forget to get the information back: In the event that due diligence ends without the consummation of a transaction, it is important that the seller eliminates access to the materials. A well-drafted nondisclosure agreement will include language that requires the prospective buyer and its representatives to return or destroy all confidential information provided in the due diligence process. When the due diligence process comes to an end, the seller should end access to any data room and remind the receiving party of its obligation to return or destroy the materials.

Carrying out the due diligence process in a thoughtful and organized manner can help a seller mitigate the disruption to business operations and keep the sales process moving forward quickly and efficiently.