The Confidential Sale Playbook

Data requiring particular care

Customer names and concentration, customer-level margins, HR personal data, trade secrets/code/recipes, disputes, banking terms, change-of-control contracts, live bids and competitively sensitive strategy.

Depending on the deal, information may be summarised, aggregated, redacted or restricted to a Clean Team.

When should employees be told?

There is no universal date. Decide with counsel by considering legal obligations, process staffing, leak risk, reliance on key managers and the point at which uncertainty becomes more dangerous than communication.

Prepare message, spokesperson, FAQ, known/unknown impacts, question channel and confidentiality expectations before communication.

Customers, suppliers and banks

Banks may need earlier engagement where consent, waiver, debt or change-of-control issues exist. Customers/suppliers depend on contract and dependency. Regulated partners may have approval requirements. Confidentiality never means ignoring consent obligations.

Buyer-access checklist

Before T2/VDR: verified identity, authority, thesis, NDA, RPS admission where applicable, scope, expiry, download policy, purpose and owner approval.

Revocation

Design the exit before granting access: expiry, manual revocation, expert assignment end, exclusivity end or buyer withdrawal. Revocation should also remove affected sources from AI/retrieval access.

If a leak occurs

Preserve logs, determine the exposure, restrict access, notify security/compliance, assess contractual/regulatory obligations, and document remediation and restart decisions.

DealPME role

RPS, T0/T1/T2, Permission Lens, VDR and logs provide structure. They do not replace seller judgement, law or professional advice.

<!-- ENHANCEMENT_V2 -->

Aggregate, redact or restrict: three different tools

Aggregation shares useful information without named detail, for example customer concentration bands. Redaction removes a specific sensitive field from an otherwise necessary document. Restriction/Clean Team gives detailed access to a limited group when evidence is material but too sensitive for the wider team.

The choice follows the diligence question. Hiding too much can prevent a buyer from reaching a conclusion; showing too much too early creates unnecessary risk.

Rehearse communication before using it

For employees, strategic customers or suppliers, prepare the core message, difficult questions, approved answers, known unknowns and contact person. A spokesperson should be able to say “we cannot answer that yet” without improvising.

What should not be sent by reflex

Named customer lists, personal HR data, technical secrets, bank credentials, passwords, API keys, unnecessary full contracts or third-party data unrelated to the diligence question. Disclosure should remain proportionate.

Mini-FAQ

Does an NDA mean everything can be shared? No. It creates a contractual obligation but does not replace permissions, data minimisation or regulatory restrictions.

Can access be restored after revocation? Only through a new authorised gate; old links or cached retrieval should not bypass revocation.

This resource explains; it is neither legal, tax or financial advice nor a formal valuation. Have your situation validated by a professional.