NDAs and Confidentiality in a Business Sale — What They Do and Don't Protect

Every sale process starts the same way: before a buyer sees a single number, they sign a Non-Disclosure Agreement. It's routine, it's quick, and most owners barely think about it beyond "sign here." That's a mistake. An NDA is one of the few protections you have before you've handed over anything valuable and understanding what it actually covers (and what it doesn't) matters far more than the two minutes most people spend on it.

What an NDA is actually for

At its simplest, an NDA is a promise: the buyer agrees not to use or share the information you give them for anything other than assessing the deal in front of them. It's not a formality to get out of the way before the "real" legal work starts, it's the first contract of the transaction, and it sets the tone for how seriously the other side treats confidentiality.

In a business sale, that matters because you're about to hand a stranger, often a competitor, sometimes a direct one, a level of insight into your business that nobody outside your senior team normally sees. Margins by customer. Supplier terms. Staff structures and pay. Pipeline. The reasons a key account might be at risk. None of that should be visible to anyone who hasn't earned the right to see it.

What a well-drafted NDA covers

A decent NDA in an M&A context should address:

• What counts as confidential information — usually drawn broadly to include financials, customer and supplier data, business plans, and anything shared verbally as well as in writing.
• Permitted use — the information can only be used to evaluate the potential transaction, not for any other commercial purpose.
• Who it can be shared with — typically the buyer's directors, advisers, and funders on a need-to-know basis, each bound by the same obligations.
• Standstill or non-solicitation provisions — sometimes bolted on, preventing the buyer from approaching your staff, customers or suppliers directly during the process.
• Duration — how long the obligations last, often two to three years from signing.
• Return or destruction of information — what happens to the data if the deal doesn't complete.

If any of these are missing or vague, the NDA is doing less work than you think it is.

What an NDA doesn't do

This is the part owners get wrong most often. An NDA is a deterrent and a legal remedy, it is not a lock on the door.

It doesn't stop someone reading what you've sent them. Once information is shared, it's shared. An NDA gives you the right to pursue a breach after the fact; it doesn't prevent the breach happening.

It's genuinely hard to prove. If a buyer walks away from a deal and their business performance quietly improves in an area where your data would have helped, proving they used your confidential information, rather than arriving at the same insight independently, is difficult and expensive. Most breaches are never pursued for exactly this reason.

It won't protect information you didn't need to share yet. The strongest form of confidentiality protection isn't legal, it's practical: controlling what you disclose and when. Early-stage enquiries don't need your customer list or your management accounts. That level of detail should be staged, released only as a buyer demonstrates genuine intent, usually once you're past initial interest and into a serious, qualified conversation.

It doesn't cover information a buyer already knew, or that's publicly available. A well-drafted NDA will carve these out explicitly, which is worth checking rather than assuming.

It's only as strong as the buyer behind it. An NDA signed by a well-funded trade buyer with a reputation to protect carries real deterrent weight. An NDA signed by an unknown or thinly capitalised party is much less of a safety net, if they breach it, there may be little practical recourse even if you win the legal argument.

The real protection is process discipline

The businesses we see run into trouble aren't usually the ones without an NDA, they're the ones who treat the NDA as the whole solution and then get loose with what they share and to whom. A good sale process protects confidentiality through structure, not just paperwork:

• Staging disclosure so sensitive detail only goes to buyers who've shown real commitment.
• Running the process through an adviser, so a buyer's approach to your staff or customers goes through a controlled channel rather than direct contact.
• Keeping the number of people who know a sale is happening as small as possible for as long as possible, competitors, staff, and customers rarely need to know before you're ready to tell them.
• Being selective about which buyers get access to a full information pack versus a teaser or anonymised overview.

This is one of the practical reasons owners bring in an adviser rather than running a process themselves: it's far easier to control disclosure, and far less awkward, when a third party is managing who sees what and when.

What to check before you sign one

If you're approached directly by a buyer and asked to sign their NDA, don't assume every NDA is the same. Worth checking:

• Is the definition of confidential information broad enough to actually cover what you'll be sharing?
• Does it include a non-solicitation clause covering your staff and customers?
• How long do the obligations last — and is that long enough to matter?
• Is it mutual (protecting information you might learn about them too) or one-sided?
• Which jurisdiction and courts would apply if you ever needed to enforce it?

None of this needs to be adversarial. A serious buyer won't object to a properly drafted NDA, if anything, it's a reasonable early signal of how they'll behave with the rest of the process.

The bottom line

An NDA is necessary, but it's not sufficient. Sign one before you share anything meaningful, always, but don't let it lull you into oversharing early. The real protection in a sale process comes from controlling the flow of information deliberately, staging what buyers see as their commitment increases, and running the whole thing through a process that limits exposure by design rather than relying on a contract to clean up after the fact.

‍