How to review a data room when buying a business

Being given access to a data room starts the work; it does not tell you how to do it. Check who chose what went into the room and how it is arranged, and find out which parts your accountant and your lawyer each need to see. A plan helps. Decide what you may do with what you see, read the index before any single document, compare what is there with the list you asked for, and keep a written record of every question and answer. This guide covers the buyer’s side only. How the platform itself works is covered in how a virtual data room works.

Before you open a folder: what the agreement allows

BDC calls the confidentiality agreement essential for you as a potential buyer, and it comes before the due diligence itself. BDC describes it as a document in which a party undertakes not to use, disclose or permit the disclosure of confidential information received during the negotiations and the due diligence process, except for the purposes of evaluating participation in the proposed transaction. Read yours as the rulebook for the room. Check who counts as a permitted recipient: your lawyer, your accountant, a lender, a partner or an investor may each need to be named or approved before they see anything. Check whether you may copy, download or print, whether you may contact employees, customers or suppliers, and what you must do with the material if the deal does not proceed. If the wording is unclear, ask your lawyer before you add anyone to the room.

Read the index first, then map it to your request list

Open the index or folder structure before any document. Put it beside the list you sent the seller. The question is not whether the room looks full but whether each item you asked for has a matching document, and whether it is the version you asked for: filed rather than draft, signed rather than unsigned, covering the full period. For a starting list, see what due diligence documents to ask for when buying a business. BDC describes due diligence as checking that the numbers match the reality on the ground, so note where one document refers to another, such as a lease named in a financial statement, and confirm both are present.

Log what is missing as you go

Keep one running log with a row for each request item. Record the folder and file name where you found it, the date you reviewed it, who on your team reviewed it, and one of three states: received, partly received, or not provided. Do not wait until the end to build it. A log kept as you read becomes the follow-up request list without extra work, and it shows you and your advisors where review is complete and where it is still open. BDC suggests assigning tasks to your acquisition team, including staff and outside consultants, with a clear deadline for each; the log is where those assignments live.

Use the Q&A process and keep your own record

Put questions in writing, one issue per question, and cite the document and page that prompted it. If the room has a Q&A function, use it rather than a phone call, so the answer sits next to the question. Then save your own copy of each question and answer, with its date, outside the room. Ask whether your access will end when the process ends, since you may want the wording later. Ask your lawyer whether the answers you received should be tied to the representations in the purchase agreement, and whether anything the seller said only on a call should be put in writing.

Personal information in the room

Employee files, customer lists and similar records may contain personal information. PIPEDA s.7.2(1) says that, in addition to the circumstances in subsections 7(2) and (3), organizations that are parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if two things are met. First, they have an agreement requiring the organization that receives the information to use and disclose it solely for purposes related to the transaction, to protect it with security safeguards appropriate to its sensitivity, and, if the transaction does not proceed, to return or destroy it within a reasonable time. Second, the information is necessary to determine whether to proceed and, if so, to complete the transaction. The Act also says an organization must comply with the terms of that agreement, and s.7.2(4) excludes a transaction whose primary purpose or result is buying, selling or leasing personal information. In practice, treat personal information in the room as held on those terms: confirm your agreement contains them, ask for only what you need, and ask your lawyer how they apply to you. Alberta, British Columbia and Quebec have their own private-sector privacy laws, deemed substantially similar to PIPEDA, and the Office of the Privacy Commissioner says an organization subject to one is generally exempt from PIPEDA for collection, use or disclosure that occurs within that province. Check which law applies where the business operates.

Treat gaps and red flags as questions, not conclusions

A missing document, a number that does not match, or a contract with an unusual term tells you what to ask next, not what to decide. Send each one back as a written follow-up: what you saw, where, what you need to understand it, and by when. BDC says due diligence lets you test your initial expectations and check there are no major red flags. Give the seller room to explain before you draw a view, because a gap alone does not tell you what caused it. Take anything that stays unexplained to your accountant and lawyer, and ask them what it means for your position.

• Name the people who may see the room, and check each is permitted under the confidentiality agreement.
• Read the index first and match it, line by line, to the request list you sent.
• Log every item as received, partly received or not provided, with the reviewer and date.
• Ask in writing, citing the document, and save your own copy of each answer outside the room.
• Download, copy or forward nothing unless the agreement and the room’s settings permit it.