Sellers should treat a competitor’s diligence request as a controlled disclosure decision, not as an automatic entitlement to the company’s records. Start with the least information needed for the question and the stage of the process. Redact customer identities and other unnecessary details, aggregate pricing and operating data, and use a counsel-designed clean team for information that remains competitively sensitive. Limit access by role, monitor the data room, and stop when a request falls outside the approved purpose. Because pre-closing information exchange and merger-control rules vary by transaction and jurisdiction, qualified counsel should design the NDA, permissions, clean-team protocol, and escalation steps.
Start with a controlled information plan
A competitor may have a legitimate reason to examine a business before making an offer, but the seller does not have to treat every request as equally necessary. Begin with an information plan that connects each requested item to a defined diligence question. The owner, transaction lead, and counsel should classify the request as essential now, potentially useful later, or unnecessary. This keeps the first exchange narrow and creates a record of why access was granted.
The plan should identify the source record, intended recipient, permitted use, access period, and person who can approve an exception. That is more useful than a general promise to be careful. The FTC recommends sharing the least amount needed for effective diligence and tailoring disclosure to the stage of the sale process. [1] A preliminary bidder usually needs less detail than a finalist preparing a final offer. At every stage, ask whether the same diligence question can be answered with an older period, a summary, a range, or a record stripped of identifiers.
Separate ordinary diligence from competitive information
Not every business record has the same competitive risk. Financial statements, organizational information, material contracts, and operational descriptions may still be confidential, but a competitor can often use current customer identities, customer-level pricing, discount rules, product roadmaps, capacity plans, supplier terms, and detailed cost data to compete even if the deal never closes. The FTC specifically identifies current and future prices, strategic plans, costs, and customer-specific information as areas requiring care. [1]
Create a request log that labels each item by sensitivity and explains the proposed treatment. A useful internal distinction is: share as provided; share only after redaction; share in aggregated or banded form; share only with a counsel-designed clean team; or defer until a later stage. This is a process choice, not a legal conclusion. Counsel should confirm how the categories apply to the transaction and jurisdictions involved. The log also gives the reviewer a stopping point when a request grows beyond its original purpose.
Use the NDA as a floor, not the whole control system
A non-disclosure agreement should define confidential information, permitted purposes, recipients, storage, compelled disclosure, return or destruction, and consequences for misuse. It should also address whether the buyer may contact customers, employees, suppliers, or other stakeholders, and who can authorize that contact. These terms should match the actual data-room settings and the seller’s review process. A promise in an agreement is not a substitute for deciding what the buyer needs to see.
Review the NDA before files are released, including any buyer request to use information for integration planning, financing, regulatory work, or a future commercial relationship. Do not assume that a broad permitted-use clause makes every disclosure appropriate. In a competitor transaction, ask counsel to identify information that should remain outside the ordinary buyer team and to define a separate approval path for exceptions. The seller should also confirm that advisers and contractors are bound before they receive access.
Redact and aggregate before disclosure
Redaction should remove identifiers and details that are not needed to answer the diligence question. For customer information, that may mean replacing names with coded IDs, removing contact details, grouping revenue by period or segment, and presenting concentration in ranges rather than naming accounts. For pricing, it may mean historical or aggregated views instead of current customer-by-customer schedules. For costs, it may mean grouped categories rather than supplier-specific rates. The correct method depends on the business and the question being answered.
Do not assume that a black box on one page is enough. Review spreadsheets, hidden tabs, formulas, metadata, file names, comments, and linked schedules. The FTC warns that bidders may piece together separate documents to reconstruct sensitive information, and recommends examining later-added schedules as well. [1] A reviewer should test whether a reasonable recipient could infer a customer, price, or strategy from the combination of files. If the answer is yes, revise the package or restrict access. Keep the unredacted source separate from the release copy and document who approved the transformation.
Design a clean team with counsel
A clean team is a restricted group that can review competitively sensitive information for a defined diligence purpose without passing raw details to people who run the buyer’s competing business. Its membership, permitted materials, reporting format, retention, and communication rules should be designed for the transaction by qualified counsel. The FTC says clean teams should not include personnel responsible for competitive planning, pricing, or strategy. [1]
The seller should ask who is on the team, what business roles they hold, whether outside advisers are involved, and what the buyer’s team may receive after review. Reports to commercial personnel should be blinded, aggregated, or otherwise limited to the conclusion needed for the transaction. Counsel should review those reports before wider circulation. A clean team is not a universal safe harbor. It is a control that must fit the facts, the information, and applicable law. If membership or permitted use changes, pause the affected disclosure until the protocol is updated.
Control the data room and permissions
Access should be granted by role and folder, not by convenience. The data-room administrator should maintain a current list of approved users, record when access is granted, limit downloads and forwarding where practical, and remove access when a person changes role or leaves the process. Sensitive folders should use a second approval step and should not be copied into a general company drive. The FTC recommends controls against downloading or emailing confidential data and warns against storing clean-team material on accessible shared drives. [1]
Assign one person to compare the request log with actual permissions. That reviewer should confirm that an uploaded file has the intended version, that a redaction survived conversion, and that an access change was recorded. Keep an exception log for urgent requests. If a requested exception cannot be reviewed in time, the stopping condition is simple: do not release the file yet. Review access reports periodically and ask counsel whether the retention settings meet the agreement and applicable law.
Keep the businesses independent before closing
A signed deal does not automatically mean the buyer can direct the seller’s day-to-day commercial decisions before closing. Depending on the transaction and jurisdiction, pre-closing coordination, standstill obligations, and merger-notification rules can create separate risks. The FTC states that parties remain independent until consummation and should protect sensitive information during the period when a transaction may still be delayed, modified, or abandoned. [1] The OECD also notes that notification and standstill rules vary substantially across jurisdictions. [2]
For that reason, route requests about customer pricing, bids, product changes, hiring, purchasing, sales territories, or other competitive conduct to counsel before responding. Do not let a diligence request become an informal instruction to change operations. For a cross-border transaction, obtain jurisdiction-specific advice rather than relying on a checklist prepared for another country. The European Commission’s horizontal-cooperation guidance likewise emphasizes that information-exchange questions are fact-specific and cannot be reduced to a mechanical checklist. [3]
Set stopping conditions and incident steps
A good process says when disclosure stops. Examples include a request for current customer-level pricing without a defined need, a request from a buyer employee in a competitive role, a file that contains unreviewed personal or customer data, a proposed use outside the NDA, or evidence that sensitive material was downloaded or forwarded contrary to the protocol. The owner or data-room lead should pause access and escalate to counsel rather than negotiate an exception informally.
If an improper disclosure occurs, preserve the access record, identify the materials and recipients, suspend further distribution, and ask counsel what notice, remediation, or regulator contact may be required. The FTC advises monitoring established protocols and stopping problematic document exchange or coordination when discovered. [1] Do not delete logs or attempt to rewrite the history. The goal is to contain the issue and make a documented decision about next steps. A failed control should also trigger a review of related files, because a recipient may have received connected schedules or copied analysis.
Close the loop when the process ends
The confidentiality process continues if the bidder withdraws, the seller chooses another buyer, or the transaction is abandoned. Review the NDA and clean-team terms for return, deletion, and destruction requirements. Ask for the required certification or confirmation, and keep the seller’s record of what was requested and what was returned. The FTC notes that destruction instructions should be clear and followed, including for internal analysis based on confidential data. [1]
A short post-process review can improve the next sale process. Record which requests were repeated, which redactions failed review, where permissions were too broad, and whether any report reached a prohibited audience. Do not retain unnecessary copies of the buyer’s work product or sensitive source material. Keep only what the agreement, law, and the seller’s documented retention policy require. Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. Acquivo gives business owners the entire sell-side process an investment bank would run, as software, with no success fee. The software is user-operated, so the owner and advisers remain responsible for approvals, legal judgment, and disclosure decisions.
Key Points
- Tie every request to a specific diligence question and disclose only what is needed at that stage.
- Classify customer, pricing, cost, strategy, and supplier information before release; use redaction, aggregation, deferral, or clean-team access as appropriate.
- Have counsel design the NDA, clean-team rules, permitted uses, and jurisdiction-specific pre-closing boundaries.
- Use role-based data-room permissions, access logs, download controls, and a named reviewer for exceptions.
- Stop disclosure when the request, recipient, file, or proposed use falls outside the approved protocol, then escalate to counsel.
- Apply return and destruction requirements even if the sale is delayed, abandoned, or awarded to another bidder.
Sources and references
Source retrieval dates record research access, not article publication. Read our editorial and date policy.
- [1] Avoiding antitrust pitfalls during pre-merger negotiations and due diligence · Accessed
- [2] Suspensory Effects of Merger Notifications and Gun Jumping · Accessed
- [3] Guidelines on the applicability of Article 101 of the Treaty on the Functioning of the European Union to horizontal co-operation agreements · Accessed
Choose your next step
Acquivo is user-operated software. Owners and their professionals remain responsible for decisions, communications, and professional review.
Educational information, not individual legal, tax, or investment advice. Consult qualified professionals for your circumstances. Acquivo provides software, not representation or negotiation on your behalf.