The importance of virtual data rooms

As the corporate transactions and M & A processes are made, one of the most important steps is to carefully deal with all the information regarding the company that is being sold. The basis for this examination is the compilation of a meaningful and complete “data room” by the seller and the examination by the interested party or buyer. What is important about data rooms?

One of the key tasks of the seller is the production of transparency to the sales objective. The job of the buyer is to check all the information. Both parties have to work carefully to complete a transaction successfully. This process is also referred to as due diligence.

Goal and Process of Due Diligence

A due diligence process gathers information about what the company to be acquired is. Due diligence processes can be very different and vary greatly in scope. Typically, they cover the legal, tax and financial sectors, but also more and more areas such as IT, insurance, environment, production processes, and human resources. The relevant information is disclosed in the form of corresponding documents in a data room and by answering supplementary question lists.

From the point of the buyer’s view, it is about examining the opportunities and risks associated with the acquisition and how the company can be integrated as quickly as possible into its structure. The result of the test procedures has accordingly the purchase decision itself, the transaction structure and/or the amount of the purchase price. If risks are identified in the due diligence, prospective buyers usually derive general and specific guarantee requirements in the purchase agreement.

Physical and virtual data spaces

Indeed, just a few years ago, there were physically protected spaces where the seller (or his lawyers and/or advisors) provided relevant information in the form of paper documents. Such a data space may well be compared to a shop window in which the seller can place the goods that are to be sold.

In other words, it is the company that is going to be sold, is presented to a very limited circle of prospective buyers for the introduction. For this purpose, the relevant documents are sorted and put together according to the main areas. 

The documents are recorded in an index, which later helps the prospective buyer or the authorized auditors to orientate themselves in the data room. These types of data spaces are also referred to as “physical data spaces” because the provision of corporate information is physical.

For some years, standardized processes of preparing, providing and retrieving information via the Internet have been used to map data spaces to electronic media. These computer- or Internet-based solutions are called virtual / electronic data rooms.


At the beginning of each sale process, sellers and prospective buyers make a so-called confidentiality agreement, which is intended to protect both the company being sold and its employees and shareholders, as the information provided is very sensitive. In addition, prospective buyers must sign a further explanation, the so-called Datraumbegehungsregeln. 

This agreement governs whether and how copies of documents may be made. If questions arise from the due diligence process, they should generally be submitted in writing and transmitted to the seller or his advisor. 

Thus, complete documentation of the examination process is possible for both sides. As with the physical Dataroom, only those persons “entering” the virtual dataroom who have previously signed the privacy agreement and the Dataroom Rule Rules, or who have accepted online, are allowed to enter.

Access Control

In the long run, virtual data rooms are nothing but servers in a high-security IT environment where data or information is stored digitally. Access, provision of data, and exploitation of the Dataroom are managed by a Dataroom administrator previously designated by the vendor. This task is usually assigned to the assigned M & A advisor or the attorney accompanying the transaction. 

The members of the due diligence team get access to the data via the internet. You have to register for this using an individual identifier and with the help of a password on the website of the Dataroom Provider. Naturally, the highest safety standards apply here to prevent unauthorized access. Often several security levels in the form of PIN and TAN numbers are given.

In addition, it can be determined in advance who will be allowed to see specific data or documents at what time, accordingly.  Importantly, less critical or public documents, which are also referred to as “green-level documents”, are already made available at the beginning of the due diligence process documents with sensitive data.

Sometimes, last, highly sensitive data, such as. For example, product cost estimates or personnel files are only made available after signing as part of a so-called “confirmatory due diligence” (confirmatory due diligence).