How Should M&A Attorneys Protect Privileged Communications During a Business Sale?

Separate confidentiality, privilege, and work product

A confidential business record is not necessarily a privileged communication. ABA Model Rule 1.6's commentary explains that professional confidentiality covers information relating to representation regardless of its source, while attorney-client privilege and work product address protections in proceedings where evidence may be compelled. These are related protections, not interchangeable labels; counsel must check the rules governing the matter. [1]

In the federal corporate-privilege context, the Supreme Court's Upjohn decision explains that privilege protects communications rather than underlying facts. Its analysis considers communications made to obtain legal advice in the circumstances before the Court. [2] Consequently, a sale-process review should not use a lawyer's presence on an email or a 'privileged' label as its classification test. The reviewing lawyer should examine purpose, participants, and context under applicable law.

Assess work product separately. Federal Rule of Evidence 502 defines that protection by reference to applicable law covering material prepared in anticipation of litigation or for trial. A transaction document should not be treated as work product simply because counsel drafted it. [5]

Identify the client and the lawyer who decides

Before collecting sale communications, record which client the engagement covers: the selling entity, an owner, or another identified party. Do not assume that every participant in an owner-led sale has the same legal interests or authority to approve disclosure. The lead transaction lawyer should resolve those questions against the engagement documents and applicable professional rules before assigning access.

Give one accountable lawyer responsibility for privilege-sensitive classification and release decisions, with a designated substitute. A document coordinator can assemble files and track decisions. A technical administrator can implement permissions. Neither role should substitute for counsel's legal assessment, and an AI tool should not approve disclosure.

Maintain a restricted decision record identifying the source file, version, proposed recipients, permitted use, reviewer, and unresolved issues. Keep legal reasoning out of the buyer-facing release log. Under the ABA model framework, reasonable efforts to prevent unauthorized disclosure and access are required; local rules and circumstances determine the applicable obligation. [4]

Screen source material before any upload

Create an intake boundary before uploading files to an external workspace or AI service. The coordinator should flag communications involving legal advice, legal investigations, settlement discussions, or mixed business and legal discussion for counsel. These flags identify review candidates, not established privilege. Hold uncertain items outside the proposed upload set until the lawyer resolves their treatment.

Use original records as the source of truth: complete email threads, native documents, attachments, and counsel's written classification decisions. A detached attachment may omit the context needed for assessment. Review comments, revision history, hidden spreadsheet tabs, embedded material, and filenames before creating a release copy. Do not use a cleaned copy to replace the preserved original.

For illustration, a buyer might request information about a contract dispute. A thread containing counsel's advice and an attached business contract should not be uploaded as one package. Counsel can assess the contract and proposed factual response separately from the advice. That separation does not eliminate factual disclosure obligations or establish privilege over the underlying facts. [2]

Keep legal advice out of transaction-wide channels

Use a restricted legal-advice channel distinct from buyer diligence, commercial scheduling, and general deal coordination. Assign membership deliberately rather than copying the transaction's entire contact list. Counsel should assess whether each participant belongs in a particular legal discussion; an adviser being useful to the deal is not itself a determination about privilege.

Make channel instructions practical. Route requests for legal advice to the restricted channel. Put approved factual responses in the buyer channel without forwarding the discussion that produced them. Treat a proposed change in recipients as a new review question, especially when a buyer, lender, consultant, or software provider would gain access. ABA commentary calls for reasonable recipient precautions and recognizes that special circumstances can warrant additional safeguards. [1]

Review shared links and inherited permissions as well as visible recipients. A restricted folder can still have operational exposure if a broader group has access elsewhere. Permission settings address access; counsel's separate legal assessment addresses privilege. Confidentiality undertakings should not be described as a guarantee against waiver.

Assess AI vendor exposure before entering client information

ABA Formal Opinion 512, issued in July 2024 under the ABA Model Rules, directs lawyers to evaluate exposure inside and outside their firms before entering representation information into generative AI tools. It also calls for understanding terms of use, privacy policies, and related contractual terms, with technical assistance when needed. Its guidance is fact-specific and does not establish a universal rule for every jurisdiction or tool. [3]

For the proposed task, counsel and a technical reviewer should document who can access inputs and outputs, retention practices, training or reuse terms, provider personnel access, and any connected retrieval sources. Consider whether the tool can draw on unrelated matters or make outputs available beyond the intended reviewers. A setting that disables training answers only part of this assessment.

Opinion 512 discusses informed consent for the self-learning tools and risks it addresses and says generic engagement-letter boilerplate is insufficient when informed consent is required. Apply that analysis alongside current local guidance and client instructions. [3] Client permission for a technology workflow is not a determination that privilege survives vendor exposure. If material terms or permissions remain unclear, do not enter the information.

Pilot a narrow task with human review and stopping conditions

Start with a task that does not require privileged inputs, such as drafting an intake checklist from public sources or fictional documents. Removing a client name alone is insufficient if context can still identify the client or situation; ABA commentary addresses indirect disclosure and identifiable hypotheticals. [1] A pilot should not send real legal correspondence to an unassessed tool to test whether the tool flags it.

A useful trial is generating a draft factual diligence response from a counsel-approved input set. The responsible lawyer should compare every proposed statement against the authorized source documents and approved disclosure scope. Check omitted qualifications, unsupported conclusions, invented facts, and language that restates legal advice. Keep a human-reviewed answer as the comparison record, not another model's output.

Stop the trial if the tool retrieves an unapproved file, reproduces withheld content, cannot identify a claimed source, or produces a material factual error. Suspend use if vendor terms or permissions change materially. Resolve the issue before considering a narrower retest. Opinion 512 requires appropriate independent verification and preserves the lawyer's responsibility for professional judgment. [3] No pilot result authorizes automatic buyer communications or release approvals.

Approve the release copy, not just the source document

Review each proposed buyer-facing output as a new disclosure. A summary, redaction, or AI-generated answer can reveal withheld advice even when the source document never leaves the legal channel. The reviewer should ask whether the output is supported by approved business records or instead depends on counsel's analysis. Rewrite or withhold material that needs further legal assessment.

Record the exact approved version, audience, and purpose before the coordinator releases it. Check the actual attachment and recipient list at release, rather than relying on an earlier approval of a similar draft. If the intended audience changes, return the item for review.

Keep privilege screening separate from the assessment of what the transaction requires the seller to disclose. Removing counsel's advice is not an instruction to conceal material facts. Counsel should address the legal disclosure question, and the authorized client representative should resolve business decisions within the agreed scope. The distinction between facts and communications remains important. [2]

Prepare a response to accidental disclosure

Set an incident route before opening buyer access. If a potentially protected item is released, pause further distribution and notify the responsible lawyer. Preserve the original, the released version, recipient information, permission history, and available access records. Have counsel direct containment, recipient requests, and any required notifications. Do not erase evidence or treat a successful link revocation as proof that nobody accessed the material.

Federal Rule of Evidence 502(b) addresses inadvertent disclosure in a federal proceeding or to a federal office or agency. Its conditions include reasonable preventive steps and prompt reasonable steps to rectify the error. Those express circumstances do not supply an automatic cure for a private-sale data-room or AI upload. Counsel must assess the applicable law and facts. [5]

Rule 502(d) concerns a federal court order addressing disclosure connected with pending litigation. Rule 502(e) limits the effect of a party agreement in a federal proceeding to its parties unless incorporated into a court order. [5] A transaction NDA or proposed return arrangement should therefore not be presented as equivalent to court-ordered protection.

Plan privilege control and file custody at closing

Closing can raise a different question from accidental disclosure: who controls a corporation's privilege after the transaction? In the Delaware Court of Chancery's 2013 Great Hill decision, the court held that privilege over pre-merger communications passed to the surviving corporation under the Delaware merger statute applied there, absent an express contractual carve-out. It discussed negotiated allocation and did not decide the alternative waiver issue. That holding should not be generalized to every asset sale, equity sale, or jurisdiction. [6]

Before closing, counsel should assess contractual allocation, document custody, system handover, access termination, and preservation duties against the transaction structure and governing law. Reconcile the agreement with the proposed file-transfer plan. Do not delete communications indiscriminately to address a privilege concern; preserve records while counsel determines lawful treatment.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks.

It is user-operated software with no success fee, not a law firm or client representative. This review framework does not assert that Acquivo provides particular privilege-screening or AI-control features. Counsel assesses legal communications and disclosures; users operate the software. A portal or AI setting does not guarantee privilege, security, or a transaction outcome.