I recently wrote about how to find businesses for sale, and how to price them. Today I’ll discuss the very first contract typically signed by a buyer and seller in the life cycle of a small or closely-held business acquisition: the non-disclosure agreement (NDA).
In nearly all deals outside of the straight “investment” or VC context, the seller requires an NDA. The buyer may also need confidentiality protections—especially if they will need to make sensitive financial disclosures, share strategic information, or simply want to keep it under wraps that they are out shopping. Therefore, some NDAs are mutual, others one-way, and still others hybrid agreements.
In nearly all deals, an NDA will arrive before a term sheet and before a serious discussion on price. It is the key to unlock the seller’s data room and, in many ways, sets the tone for the entire transaction.
Over the years, I’ve seen all manner of NDAs: the good, the bad and the ugly. People often give this agreement short shrift, thinking it’s sheer boilerplate and less than consequential. That’s wrong! It can also be dangerous— even months or years after a sale falls through. In fact, our office has handled several litigations arising out of alleged NDA breaches, and I’ve seen parties lose valuable intellectual property due to careless NDAs.
For buyers specifically, the NDA defines what you can learn, how you can use that knowledge, who on your team is allowed to see it, and what happens if the deal never closes. Approaching an NDA with the same care you would apply to the purchase agreement is crucial.
Why buyers should care about the NDA (beyond getting access)
Sellers insist on NDAs for obvious reasons: they are about to share trade secrets, customer lists, financials and other sensitive information that could harm their business if leaked or misused.
From the buyer’s perspective, the NDA does more than reassure the seller. It establishes the rules of engagement for due diligence and creates a legal framework that, if poorly drafted, can expose the buyer to lasting liability. A buyer who signs an overbroad or one-sided NDA may find itself constrained in how it operates post-diligence, vulnerable to claims of trade secret misappropriation, or even barred from pursuing other opportunities in the same market.
In short, the NDA is the first place where the buyer’s risk profile in the transaction is defined. Take good care here.
NDAs are negotiable (usually)
Most NDAs are generated from standard forms, ideally tailored by counsel. Most are subject to negotiation. The terms available to buyers will vary, of course. Here are a few examples:
- I helped sell a business last year, for roughly $30M, with the help of a middle-market investment bank. The bank served as broker on the deal. They reached out to hundreds of potential buyers with the confidential sale opportunity, and sent our NDA to all responding with interest. Maybe 40 or 50 potential buyers replied with change requests to the NDA. Because there were so many parties, and because the business was well-priced, the seller made very few concessions.
- I helped buy a business last year, for roughly $2.5M, without brokers. The seller sent us a miserable form NDA, probably sourced online. The NDA contained non-market provisions and even terms that were bad for the seller. Both parties wanted the deal, and we succeeded in getting numerous changes for the buyer.
In short, the NDA should be treated with as much care as any document you will sign in a transaction. The good news is that NDAs, by their nature, are relatively non-complex. Experienced counsel will be able to identify hotspots and move through the exercise quickly.
The anatomy of a buyer-friendly NDA
A well-constructed NDA begins with a clear and balanced definition of “Confidential Information.” The ideal definition captures information that the seller has marked as confidential or that, under the circumstances, should reasonably be treated as such. Equally important are the standard exclusions that keep the definition from swallowing ordinary knowledge:
- information that is or becomes publicly available through no fault of the buyer;
- information the buyer already knew prior to disclosure;
- information independently developed without use of the seller’s confidential data; and
- information received from a third party without restriction.
Without these basic carveouts, a buyer risks being accused of breach simply for relying on industry knowledge or its own pre-existing expertise.
Once the scope of confidential information is settled, the NDA must clearly articulate the permitted purpose and the permitted recipients. The permitted purpose should be narrowly tailored to evaluating, negotiating, financing and consummating the potential transaction, and it should deny the seller any basis to claim that the buyer used the information for competitive purposes.
The list of permitted recipients should be broad enough to include the buyer’s lawyers, accountants, investment bankers, and potential lenders or equity financing sources—as well as the buyer’s own employees and affiliates who need access to conduct diligence. Permission to share confidential information does not mean every communication remains privileged; including brokers and other advisers on legal communications can create a separate and serious waiver risk. In my view, buyers should resist requirements that force all of these parties to also sign a separate NDA.
The confidentiality obligations themselves are typically framed around a duty of care similar to what the buyer uses to protect its own confidential information (and in no event less than a reasonable standard of care). The buyer is also expected to limit further disclosure to permitted recipients who are themselves bound by confidentiality obligations, and to notify the seller promptly in the event of any unauthorized disclosure. These obligations should be accepted, but buyers should also watch out for language that imposes strict liability or absolute guarantees against leaks, which can create unfair exposures.
The term and survival provisions of the NDA are equally critical. Most NDAs impose confidentiality obligations for a fixed period—commonly one to five years—though trade secrets should be protected for as long as the information remains legally protectable. The buyer should pay close attention to when the clock starts (at signing or at first disclosure), whether the obligations survive the termination of discussions, and for how long. And calendar each of those things.
- Note: a longer “term” on the NDA increases the buyer’s compliance burden and the risk that ordinary business activities could be construed as a breach—particularly if the buyer operates in adjacent markets, or later encounters similar information from other sources. Ideally, a buyer will limit the term as much as possible.
Most NDAs also require the buyer to “return or destroy” the seller’s confidential materials if the transaction does not proceed. While this is typical boilerplate, buyers should ensure the requirements are operationally workable. In that process, buyers should also negotiate for carveouts to allow them to retain one archival copy of the diligence file for legal compliance or internal recordkeeping purposes, consistent with their document retention policies. Without such a carveout, a buyer could be forced to delete diligence materials that it legitimately needs to keep for regulatory, tax, or litigation hold reasons.
Two additional provisions, though often overlooked, are worth highlighting:
First, the NDA should expressly state that neither party is under any obligation to consummate a transaction, and that no intellectual property license is granted. These provisions are understood intuitively by most buyers and sellers, but it’s important to commit them to writing.
Second, the remedies section should be balanced. Sellers often include language acknowledging that a breach may cause irreparable harm and that injunctive relief is available (often without bond). Buyers should ensure that any fee-shifting or damages provisions are mutual or, at a minimum, reasonable, and that injunctive relief us available only for an actual or credibly threatened breach–rather than simply because seller speculates a violation may occur.
Finally, buyers should watch for standstill, employee non-solicitation, and no-hire provisions embedded in the NDA. These are substantive restrictive covenants, not ordinary confidentiality terms. Any employee restriction should be narrowly tailored in duration and scope. It should exclude general solicitations, unsolicited applications, pre-existing contacts, and employees who were not identified through the diligence process. Broad no-hire restrictions may also raise enforceability concerns.
NDA process considerations for the prudent buyer
Beyond the text of the NDA, buyers should adopt sound processes to manage risk. The NDA should be executed by an entity capable of assuming the contractual obligations, and that is able to control the recipients of confidential information. Internally, the buyer should also gatekeep who actually receives the confidential information.
Because independent development can be a powerful defense against trade secret misappropriation claims, buyers should document their own development processes and retain records that demonstrate when and how similar knowledge was created without reliance on the seller’s confidential information.
Closing thoughts on NDAs
The NDA is usually the first substantive contract in an acquisition. For buyers, it is far more than a key to the data room. It is a risk-management tool that, if carefully drafted and negotiated, can protect the buyer from unnecessary liability while still giving the seller the confidence to share sensitive information.
By focusing on a clear definition of confidential information, a well-tailored permitted purpose, reasonable confidentiality obligations, an appropriate term, and balanced remedies, a buyer can enter diligence its risks properly managed. With sound internal processes in place, the buyer can navigate the diligence phase with confidence, knowing that the foundation of the transaction is solid.
