Questions answered
- How should confidential data be protected in due diligence?
- Does an NDA grant access to everything?
- What VDR controls matter?
Confidentiality is not the opposite of transparency
Serious transactions require transparency, but transparency is not the same as unrestricted distribution.
Detailed financials, customer files, contracts, personal data, trade secrets, price, litigation and technical documents may all be necessary for diligence while remaining sensitive. Access governance is therefore part of transaction quality rather than administrative friction.
ISO/IEC 27001 frames information security around confidentiality, integrity and availability. In an M&A VDR, those principles translate into granular permissions, encryption, auditability and active rights management.
Start before the VDR: classify information
Before buyers are invited, a seller should know what information exists, who owns it and at what stage it can be released.
DealPME's T0/T1/T2 logic formalises that progression. T0 supports limited discovery, T1 provides broader anonymised information, and T2 opens identity, terms and VDR access only after the relevant gates.
This is particularly important in share deals where public disclosure of identity, price or terms can create commercial and regulatory risk.
What an NDA does - and does not do
An NDA creates contractual confidentiality and use obligations. It can be essential, but it is not universal access permission.
After signature, the information owner still needs to decide which folders are visible, whether downloading is allowed, what should be redacted, whether a clean team is needed, when access expires and how revocation propagates.
An NDA without technical permission controls leaves a gap between legal obligation and operational reality.
