What NDA Terms Should Counsel Review Before Giving Bidders Access to Seller Information?

Start with the signed agreement and the information being released

Use the executed NDA, amendments, and written consents as the contractual source of truth. Confirm the receiving entity, covered seller entities, signatory authority, and effective date. Match that record to the proposed recipients and documents rather than relying on a bidder's display name in a portal. The UK Intellectual Property Office's guidance specifically emphasizes checking signature authority and recording what is disclosed, although its legal discussion is UK-specific. [1]

Read the definition of confidential information for oral disclosures, presentations, previously supplied materials, and analyses derived from seller records. A publicly filed transaction NDA dated March 18, 2025 expressly includes notes, summaries, and analyses reflecting the information, whether or not the original material is labeled confidential. That is a contractual example, not a rule imposed by the SEC. [3] Identify any separate review needed for personal data, third-party restrictions, privilege, or competitively sensitive information. Do not treat signing an NDA as the entire disclosure decision.

Tie permitted use to the actual transaction task

A confidentiality promise and a permitted-use restriction answer different questions: who may learn the information, and what they may do with it. The IPO guidance recommends specifying the permitted purpose precisely. Its model agreement restricts use to that purpose unless the disclosing party first agrees otherwise in writing. [1] [2] Counsel should compare the proposed activity with the negotiated wording, including whether it covers evaluation only or also financing and transaction negotiation.

For an illustrative bidder request to summarize customer contracts with AI, define the task narrowly: extract termination and assignment provisions for evaluating this proposed acquisition. Then review whether submitting the contracts to the proposed service and retaining the resulting summaries fit the agreement. Training a reusable model, improving a vendor's general service, or using seller information for another investment requires separate examination. Do not assume that a useful output makes every intermediate use permissible. Escalate any mismatch before processing, and document the contractual permission or approved change.

Map representatives and responsibility beyond the bidder

Check the defined term for representatives rather than assuming that every adviser, affiliate, lender, co-investor, or technology provider qualifies. The filed NDA defines categories of representatives, conditions access on need to know and notice of confidentiality obligations, requires prior written consent for potential financing sources, and makes the receiving party responsible for covered representative breaches. Those provisions illustrate issues to examine, not a mandatory form for every sale. [3]

Create a recipient map identifying the entity, its role, the information requested, and any consent or downstream undertaking required by the NDA. For technology-assisted review, include the service operator and any other entities that may receive content under the proposed arrangement. Counsel should determine whether they fit the permitted categories and whether their commitments satisfy the agreement. The process lead verifies the recipients against that determination. An email domain, portal invitation, or bidder assurance should not replace the missing contract analysis or written permission.

Separate contact restrictions from access permissions

Review provisions directing information requests through designated contacts and limiting approaches to management, employees, customers, suppliers, or lenders. The filed transaction NDA channels transaction communications through designated persons and restricts transaction-related contact without written consent. It also distinguishes ordinary-course communications unrelated to the transaction. [3] An NDA that protects documents may therefore impose separate conditions on how diligence conversations occur.

Translate the reviewed text into a practical routing instruction: who receives questions, who may arrange meetings, and who can authorize an exception. Keep contact restrictions distinct from any employee non-solicitation or other restrictive covenant. Their scope and enforceability call for counsel's jurisdiction-specific assessment, not a software rule. Where a bidder already has a commercial relationship with the seller, counsel should clarify the boundary between ordinary business and transaction inquiries. AI may help organize questions for human review, but must not initiate outreach or decide whether an exception applies.

Review exclusions and legally protected disclosures separately

Identify exclusions for information already known, publicly available without a breach, lawfully obtained elsewhere, independently developed, or released with written approval. Check the conditions and evidence required, not just the headings. The filed NDA, for example, calls for records supporting prior possession and requires independent development without use of the confidential information. [3] Labeling an AI summary as newly generated does not establish that it meets an independent-development exclusion.

Then review the procedure for compelled disclosure, including notice where lawful, counsel consultation, and limiting disclosure to what is required. The filed NDA contains those conditions. [3] Keep protected reporting separate: in the United States, SEC Rule 21F-17 prohibits impeding direct communications with SEC staff about possible securities-law violations, including through confidentiality agreements. SEC staff guidance warns that notice or approval requirements can interfere with reporting and notes that the protection is not limited to employment relationships. [5] Counsel should reconcile the clauses with applicable protections rather than impose a blanket advance-notice requirement.

Make return, destruction, and survival obligations workable

Review the trigger for ending access, the deadline for action, responsibility for representatives' copies, and any required confirmation. Include downloaded documents and derived materials, not just the originals. The IPO model requires return of all copies and records on request without retention. The filed transaction NDA instead allows defined legal-file and backup retention exceptions subject to continuing restrictions. Neither approach should be assumed to appear in another agreement. [2] [3]

For proposed AI processing, ask what happens to uploaded files, prompts, outputs, retrieval indexes, logs, and backups, where those records exist. Obtain evidence about retention and deletion capabilities before accepting a return or destruction promise. If a provider cannot meet the negotiated obligation, counsel must resolve the mismatch before use. Also check confidentiality duration, continued obligations for retained records, governing law, forum, and remedy provisions. Their interpretation depends on the contract and applicable law. Closing a portal account is only an access action, not proof that downstream copies have been handled.

Evaluate the AI arrangement before uploading seller material

Assign a transaction lawyer to own the legal review and a designated technology reviewer to gather the processing facts. Request the applicable service contract, privacy terms, processing terms, and account-specific configuration documentation. Record who can access content, any secondary uses, retention periods, deletion limits, and relevant locations of processing. Compare those facts with the NDA's use, recipient, confidentiality, and destruction clauses. Treat undocumented answers as unresolved, not as favorable assumptions.

ABA Formal Opinion 512, issued July 29, 2024, advises lawyers to understand tool terms and assess risks of improper disclosure or access before inputting representation-related information. Its discussion of self-learning tools explains circumstances requiring informed client consent and says generic engagement-letter boilerplate is insufficient when that consent is required. The opinion interprets ABA Model Rules; counsel must check the applicable jurisdiction's rules. [4] Client consent and the seller's contractual permission are separate questions. Neither a setting labeled private nor an NDA clause should be presented as a guarantee of privilege, security, or compliance.

Pilot clause extraction with explicit human stopping points

Begin with public sample language or synthetic documents containing no transaction confidences. Ask the tool to identify the permitted-use clause, representative definition, consent requirements, disclosure exceptions, and return obligations. Require the clause number and exact supporting text for each finding, and require missing or ambiguous provisions to be flagged. This is extraction assistance, not authority to interpret obligations or recommend final terms.

The reviewing lawyer compares every pilot finding with the complete source, including definitions, exceptions, and cross-references. Check for invented quotations, omitted qualifiers, wrong versions, and a confused distinction between mandatory language and permissions. ABA Opinion 512 discusses task-dependent independent verification and testing a smaller subset against manual review; it does not allow professional judgment to be delegated to the tool. [4] Stop the pilot on a material omission, fabricated text, unexpected access or retention, or an unresolved permission question. Resume only after human correction and reassessment. Even a satisfactory pilot does not authorize uploading seller documents: the separate contractual and confidentiality gates must be cleared first.

Finish with a counsel-owned release checklist

Prepare one checklist with entries for the executed version and parties; protected information and derived records; permitted purpose; recipients and responsibility; contact routing; exclusions and lawful-disclosure procedures; duration and remedies; and return or destruction. Add an AI entry describing the exact task, provider arrangement, downstream recipients, retention evidence, and pilot result. Each entry should identify its source clause, open question, accountable reviewer, required permission, and decision. Record no clause found when appropriate rather than filling a gap with presumed language.

Counsel resolves legal interpretation and approves proposed contractual changes for the parties' authorized decision-makers. The authorized seller representative decides the release scope; the process operator applies access instructions and records the action. Reopen the review when the provider, task, recipient, information category, or NDA changes. Where privilege is in question, pause disclosure for qualified counsel's assessment instead of assuming a confidentiality recital settles it.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. It is user-operated software with no success fee, not a client representative or legal adviser. This recommended checklist is a workflow framework, not a claim that the platform automatically interprets NDAs, approves recipients, or performs every control described here.