NDA for Mergers and Acquisitions: Due Diligence Guide

Role of NDAs in M&A

In mergers and acquisitions, the NDA (often called a confidentiality agreement or CA in M&A contexts) is one of the first documents signed and one of the most important. It governs the exchange of highly sensitive information that both parties need to evaluate the transaction.

During M&A due diligence, the target company shares detailed financial statements, tax records, customer contracts, employee compensation data, intellectual property documentation, litigation history, and strategic plans. The buyer shares information about its acquisition strategy, financing terms, and integration plans. The NDA protects all of this information.

The M&A NDA serves several critical functions beyond basic confidentiality. It prevents the buyer from using the information for competitive purposes if the deal falls through. It restricts the buyer from approaching the target's customers, employees, or suppliers directly. And it establishes the framework for data room access and information management throughout the deal process.

When the NDA is signed

In a typical M&A process, the NDA is signed after initial expressions of interest but before any detailed information is shared. The sequence is usually: initial contact and expression of interest, signing the NDA, sharing a confidential information memorandum (CIM) or management presentation, conducting due diligence, and negotiating the definitive agreement.

The NDA should be fully executed before the seller shares any non-public information, including financial summaries, customer data, or operational details. Even a brief management presentation may contain material non-public information that warrants NDA protection.

In auction processes (where multiple potential buyers are evaluating the target), each bidder signs the same NDA. The seller's advisors typically prepare a standard form NDA that is sent to all interested parties.

Essential M&A NDA provisions

M&A NDAs include several provisions that are specific to the transaction context.

Broad definition of confidential information: M&A NDAs typically use the broadest defensible definition because the range of information shared during due diligence is extensive and unpredictable. The definition should cover all information provided by the target, its advisors, and its representatives, regardless of form or medium.

Transaction confidentiality: Beyond protecting specific data, the NDA should protect the existence of the transaction discussions themselves. Public knowledge of a potential sale can disrupt a company's relationships with customers, employees, and suppliers.

Standstill clause: This provision prevents the buyer from making a hostile bid for the target or acquiring the target's stock on the open market during the negotiation period. Standstill clauses are common in friendly M&A transactions.

Non-solicitation of employees: This prevents the buyer from recruiting the target's key employees during and after the deal process. If the deal fails, the target does not want to lose its best people to the failed acquirer.

Customer and supplier restrictions: The buyer is prohibited from contacting the target's customers and suppliers directly without the target's consent. Direct contact could disrupt existing relationships.

Clean team provisions: For deals involving direct competitors, a clean team arrangement limits access to the most sensitive competitive information to a small group of designated individuals who are walled off from competitive decision-making.

Buyer vs. seller perspectives

Buyers and sellers have different priorities in negotiating M&A NDAs.

Sellers want broad definitions of confidential information, strict restrictions on the buyer's use and sharing of information, strong employee and customer non-solicitation provisions, long confidentiality periods, and the ability to enforce the NDA through injunctive relief.

Buyers want reasonable definitions that do not inadvertently restrict their existing knowledge, the ability to share information with their financing sources, advisors, and co-investors, reasonable employee non-solicitation terms that do not prevent them from hiring people who apply independently, manageable confidentiality periods, and carve-outs for information that becomes publicly available.

The negotiation typically results in compromises on both sides. Understanding each party's priorities helps you negotiate effectively and identify which provisions are most important to protect.

Data room considerations

Modern M&A due diligence is conducted primarily through virtual data rooms (VDRs) — secure online platforms where the target uploads documents and the buyer's team reviews them. The NDA should address data room access specifically.

Access controls: The NDA should specify who is authorized to access the data room and what credentials are required. Access should be limited to specific individuals identified by name or role.

Activity tracking: Most VDRs track user activity — which documents were viewed, by whom, and for how long. The NDA should authorize this tracking and specify how the logs will be used.

Downloading and printing restrictions: The NDA should specify whether data room documents can be downloaded, printed, or only viewed online. Many sellers restrict downloading to prevent information from spreading beyond controlled environments.

Data room closure: The NDA should address what happens to data room contents if the deal does not close. Typically, the buyer's access is revoked, any downloaded materials must be destroyed, and a destruction certificate must be provided.

Common negotiation points

Several provisions in M&A NDAs are frequently negotiated.

Permitted disclosures: Buyers typically request the ability to share confidential information with their lenders, equity co-investors, accountants, and legal advisors. The NDA should require that these recipients be bound by similar confidentiality obligations.

Standstill scope and duration: The buyer may resist a broad standstill clause or seek a shorter duration. The seller typically wants the standstill to remain in effect for 12 to 18 months.

Definition scope: Buyers may push to narrow the definition of confidential information to exclude information they already possess or can independently develop. Sellers prefer the broadest possible definition.

Remedy provisions: Sellers typically insist on provisions acknowledging that monetary damages would be inadequate and that injunctive relief is appropriate. Buyers generally accept this provision because it is standard and well-established in M&A practice.

Residuals clause: Some buyers request a clause allowing them to retain and use general knowledge and experience gained during due diligence, even if the deal does not close. Sellers typically resist this provision because it can effectively nullify significant portions of the NDA.

After the deal closes or fails

The NDA's role continues after the deal process concludes, regardless of the outcome.

If the deal closes, the NDA's provisions are typically incorporated into or superseded by the definitive acquisition agreement. Confidentiality obligations continue under the broader deal documents, and the standalone NDA effectively merges into the transaction.

If the deal fails, the NDA remains in full force for its stated term (typically two to three years). The buyer must return or destroy all confidential materials, revoke data room access, and comply with all ongoing restrictions including non-solicitation and standstill provisions.

For failed deals, the NDA is your primary protection against the buyer using the detailed information they obtained during due diligence for competitive purposes. This is when the quality and specificity of the NDA's terms matter most.