In this guide
A useful starting point
Confidentiality is managed through the whole process: a careful initial description, appropriate agreements, staged access and a record of disclosure decisions. An NDA is one part of that protection, not a guarantee that information cannot escape.
Begin with an outline that does not identify the business unnecessarily
A first conversation with an advisor does not require you to send customer lists, employee files or detailed product economics. Explain the type of business, your broad objectives and any concerns about who might learn of a possible sale. Agree what further information is needed and how it should be exchanged.
An anonymous summary also needs judgment. A distinctive location, exact revenue, a photograph or a combination of unusual details may identify the company even when its name is missing. Review the summary from the perspective of someone who knows your market. Agree which buyers may be approached and who approves exceptions.
Use an agreement and an access plan together
A confidentiality agreement should address the information covered and its permitted use and disclosure. Counsel should tailor it to the parties and proposed process. WIPO treats agreements as part of wider information management, rather than a substitute for access controls. [1]
Before opening access, decide who will administer it, how requests will be reviewed and which records remain restricted. Give each document an owner inside the company who can explain it and approve an appropriate version. A controlled data room can organize access, but the software cannot decide whether a record is appropriate to release.
Contact rules deserve a specific discussion. Ask counsel how the proposed terms address approaches to employees, customers and suppliers, including ordinary-course relationships and exceptions. Plan how concerns or suspected misuse will be escalated. The actual agreement and applicable law determine what can be required or enforced.
Match the disclosure to the question being answered
The following is a discussion framework, not a universal disclosure sequence. A single buyer and a competitive process may require different arrangements. For each request, ask why the detail is needed now and whether a less sensitive form would answer the question.
Scroll across the table to see all columns.
| Buyer’s question | Possible starting point | Decision before release |
|---|---|---|
| Does the business fit our interests? | An approved broad description and limited summary results. | Could this identify the business? |
| How durable is revenue? | A reviewed summary of customer mix and trends. | Can identities or terms stay masked? |
| What supports the financial story? | Selected supporting records through agreed access. | Who needs the detail and under what restrictions? |
| Can we complete the transaction? | A managed request list with specialist review. | What approvals, consents or controls remain? |
Keep a release record: requested information, purpose, sensitivity, approved recipients, approved form and decision. Consistency matters when several buyers or advisors are involved; each should work from an accurate, controlled version of the information.
Treat a competitor’s requests with particular care
The FTC warns about sharing competitively sensitive information, including current or future pricing, strategy and costs, during merger discussions. Businesses remain independent before closing. A clean team is a restricted group, often including outside specialists, that reviews sensitive material under agreed controls. Transaction and antitrust counsel should determine whether aggregation, restricted access or a clean team is appropriate; competitive pricing or strategy personnel should not receive restricted clean-team information. [2]
Ask the buyer to explain the commercial question before agreeing to a sensitive request. A signed NDA alone is not a reason to send forward pricing plans or unrestricted customer-level economics. Neither a clean-team label nor a data-room permission automatically resolves the legal issues.
Include personal records and the end of discussions in the plan
Employee and customer files can contain personal information unnecessary for the current diligence question. FTC guidance recommends knowing what personal information a business holds and limiting access to what is needed. Review records and contractual or legal restrictions with the appropriate specialists before disclosure. [3]
Agree how access will close if a buyer withdraws, and how copies, backups and legally required retention will be handled under the applicable arrangements. An access log is useful, but it does not establish that no copy exists elsewhere. Plan employee, customer and supplier communications with counsel and the relevant business leaders, including any required notices; timing should not be left to rumor.
Bring this into a conversation
Questions for the first process discussion
- Who approves approaches to buyers and sensitive disclosures?
- Which information should stay restricted even after an NDA?
- Which prospective buyers compete with us?
- Can a request be answered through a summary, redaction or specialist review?
- What happens to access and records if discussions end?
Sources & context
The sources below inform the factual explanations. Examples, worksheets and questions are ThirdSide’s editorial applications. They organize a discussion; the actual business, agreements and appropriate professional advice determine the decisions.
- WIPO · Trade secret management ↗
Agreements and practical information protection; not a statement of U.S. enforceability.
- FTC · Pre-merger negotiations and due diligence ↗
Competitor information sharing, independent operations and restricted diligence access.
- FTC · Protecting Personal Information ↗
Information inventory, access limits and protecting personal records.
Sources checked October 26, 2026. These resources provide general educational context and do not replace advice on your particular transaction.
When you want to talk it through
Discuss how a confidential process could begin
Start with the business, your objectives and the questions you would like to resolve. Detailed confidential records can follow through an agreed process.
Start a conversation