In his latest Coffee Break Briefing, insolvency expert Malcolm Niekirk explores Non-Disclosure Agreements (NDAs), covering:
- their purpose in business asset sales by insolvency practitioners,
- the key terms typically included,
- when they are useful (and when they may not be necessary), and
- their wider uses in insolvency and commercial matters.
If you missed this webinar, you can watch the recording below.
What is the purpose of an NDA in an asset sale?
A business is made up of much more than its physical assets. Most of its realisable value can lie in intangibles such as its reputation, customer relationships, goodwill, trade secrets, data and intellectual property. Very often even its tangible assets will belong to someone else, such as leased equipment or premises.
When a business is being sold, potential buyers will often need access to confidential information to help them decide whether to go ahead with the purchase. This is where an NDA can be useful, as it helps protect sensitive business information and prevents it from being shared or used inappropriately, even if the sale falls through.
It is also worth remembering that information does not have to be covered by an NDA to be confidential. Some information is confidential by its very nature, and clearly marking documents as 'confidential', when appropriate, can help protect it.
The law recognises a general duty of confidentiality. NDAs add to that, by also creating a contractual duty of confidentiality. NDAs can offer better defined and more useful rights.
What does the sale process involve?
The sale process typically begins by marketing a business and attracting potential buyers. These interested parties may include competitors, investors or existing management looking to complete a management buyout (MBO).
Each type of buyer may require a different level of due diligence and present a different risk to the security of the seller’s confidential information:
- Competitors (outside interest): These are likely to ask for the most due diligence as they will have little first-hand knowledge of the business. They may present a significant security risk. This is because they might use the commercially sensitive information disclosed to them to benefit their own business.
- Investors (mixed interest): This category of bidder will include senior management from the seller, as well as unconnected investors. The investors are likely to ask for access to business information to assess the opportunity. They should not need so much, because of their connection with senior management. For that reason, they may represent a less serious security risk.
- Existing management (inside interest): This might be described as an MBO or, less kindly, as a phoenix. A buyer of this sort usually requires less due diligence as they are already familiar with the business and how it operates. Because of the limited disclosure of confidential material, they generally present a lower security risk.
The level of information required by a potential buyer therefore influences the security risk for the seller.
How can information be disclosed to potential buyers?
There are several ways confidential information can be shared with potential buyers during the sale process. These include:
- Informal question and answer (Q&A) sessions.
- Formal Q&A processes.
- Virtual data rooms.
- Physical data rooms.
Each approach allows buyers to obtain the information they need to assess the business, but it is important that appropriate safeguards are in place to protect the seller's information.
How can businesses protect information disclosed to buyers?
Businesses can use several measures to protect confidential information throughout the sale process, including:
- NDAs: Require potential buyers to keep disclosed information confidential.
- Personal NDAs: Obtain individual confidentiality undertakings from people working for the buyer. This may be covered in the main NDA, or the seller may ask for separate personal undertakings.
- Data room rules: Restrict the copying of information, control who has access to the data room and supervise visitors to physical data rooms.
- Phased disclosure: Release information in stages rather than providing all commercially sensitive information at once.
These measures can help reduce the risk of confidential information being misused.
Should NDA terms be included in the heads of terms?
Sometimes NDA provisions are included in heads of terms. Make sure the NDA provisions are legally binding, if you do this.
Heads of terms are generally expressly stated to be non-binding and subject to contract. Therefore, any NDA provisions included within them must be clearly identified as legally binding if they are intended to take effect.
For example: ‘Clauses [7–10] are legally binding and, for these clauses, English law applies and the English courts have non-exclusive jurisdiction.’
What points are typically included in an NDA?
A typical NDA should address four key areas:
- Who?
Who is bound by the agreement?
- What?
What information is considered confidential?
- How?
How can the recipient use the information, and what is prohibited?
- When?
How long does the NDA last?
Who is bound by the NDA?
An NDA should make it clear who is expected to follow its confidentiality requirements. This will usually include the prospective buyer, but it is also important to consider the individuals working for them. This can be done by referring to individuals within the agreement or asking them to sign their own personal confidentiality undertakings.
Professional advisers should also be covered, with an express duty of confidentiality to ensure that any information shared with them remains protected.
What information is considered confidential?
NDAs will normally include a definition of what constitutes 'confidential information', clearly establishing which information is protected by the agreement.
They should also identify what is excluded from the definition. This may include:
- Information already in the public domain, as long as it is not entered the public domain through an improper release by the recipient.
- Information the recipient can prove they already knew, either because they:
- obtained it legitimately from another source; or
- generated legitimately it themselves.
How can the recipient use confidential information?
An NDA should set out how the recipient is permitted to use the information and what restrictions apply.
Generally, confidential information should only be used to evaluate the proposed purchase. Access should be restricted to individuals with a strict 'need to know', such as senior management and professional advisers who are subject to confidentiality obligations.
Businesses should carefully consider whether extending access to group companies and investors is appropriate, as this may go too far.
The recipient should also be required to:
- Store confidential information securely.
- Notify the owner if anyone gains unauthorised access to the information.
- Only disclose information where legally required to do so, and then only to the minimum extent permitted.
- Undertake not to use confidential information to solicit employees, customers or suppliers.
How long should an NDA last?
An NDA should establish what happens to confidential information when the sale process ends or the transaction is completed.
The seller can require the return of the information, and the buyer's right to retain it ends on completion of the sale. The buyer must then return or destroy the information. Backup copies may need to be kept, pending routine overwriting of the data.
The buyer should be required to confirm that this has been completed. They may need to keep some of the data for regulatory compliance purposes only.
The terms of an NDA typically expire after three to five years, although it may be reasonable to protect certain trade secrets indefinitely.
Are generic NDA templates suitable?
Generic NDA templates are easy to find and are often signed quickly with little consideration. However, it is important to ensure that any template is appropriate for the specific circumstances and provides a reasonable degree of protection.
Simply using an agreement that has been prepared previously without reviewing whether it is suitable can leave the seller at risk.
Can an NDA be used to test a potential buyer?
The negotiation of an NDA can also provide an indication of how a potential buyer may approach the wider transaction.
For example, if a buyer makes a significant issue of negotiating the NDA's terms, it may raise questions about how difficult the wider sale process could become, particularly when negotiating the sale and purchase agreement (SPA).
What should businesses consider when sharing personal data under GDPR?
Information about living individuals is protected by the General Data Protection Regulation (GDPR).
Different types of personal information carry different levels of privacy, and the circumstances will determine whether sharing that information is permitted. In some situations, consent may be required, while in others, sharing may be permitted on the basis of legitimate interests.
The recipient should also undertake to comply with GDPR when handling personal information.
What are common mistakes to avoid when preparing an NDA?
There are several common mistakes businesses should avoid when preparing an NDA.
Firstly, it is important to identify the correct corporate entities, including their full registered company names and company numbers.
The agreement should also be drafted in balanced terms. For example, businesses should avoid definitions of confidential information that are too wide or confidentiality obligations that last indefinitely where this is not appropriate.
Another common issue is simply using a previously prepared agreement without considering whether it fits the circumstances of the current transaction.
When is an NDA useful, and when might it not be?
Although NDAs can provide legal protection, in a business sale they are not enough, by themselves.
Suppose a potential buyer takes confidential information and uses it without permission. There are practical considerations about whether the seller can and should take legal action.
For example, where a company is insolvent, would it have the funds to pursue a non-buyer who has misused its information? What loss has the company actually suffered, and would pursuing a claim be a sensible use of its limited funds?
The NDA should be written in terms that will allow the seller to assigned it to the successful bidder. This will encourage signatories to it to treat it seriously.
Although an NDA may be legally binding, enforcing it can be complicated in practice.
What additional steps can businesses take to protect confidential information?
An NDA should not be the only measure businesses rely on to control sharing commercially sensitive information.
Additional steps can include:
- Finding out exactly what the bidder wants to know and why they need the information.
- Redacting sensitive information before it is shared.
- Providing information in a summarised form.
- Withholding the most sensitive information until the bidder has demonstrated that they are serious about the purchase.
Taking these precautions can help limit the amount of confidential information disclosed and reduce the risk of misuse.
What other situations can NDAs be used in?
NDAs are not limited to business sales. They can also be used in a range of insolvency and general commercial situations.
In insolvency matters, they may be used during restructuring negotiations with creditors.
More generally, NDAs can form part of employment contracts, supply and other commercial contracts, and settlement agreements.
What restrictions apply to NDAs involving individuals?
NDAs involving individuals can sometimes be oppressive, and there are various laws, rules and guidance designed to minimise this.
These restrictions apply particularly in the context of employees' rights and the settlement of litigation and other disputes.
Certain disclosures must always be permitted, including:
- Whistleblowing, such as:
- Reporting crime.
- Reporting professional misconduct, including to the Solicitors Regulation Authority (SRA).
- Ensuring fair treatment of the individual.
Solicitors are also professionally warned against drafting NDAs that:
- Include unenforceable clauses.
- Use warranties or indemnities to prevent individuals from exercising their rights.
- Mislead signatories about their legal rights.
It is therefore important that NDAs are drafted fairly and do not attempt to restrict individuals from exercising their legal rights.
What are the key takeaways?
NDAs are not a one-size-fits-all solution. Not every business sale requires a complex NDA, or even an NDA at all. But some transactions require significant confidentiality protections.
Where NDA provisions are included in the heads of terms, businesses must ensure that those clauses are legally binding.
It is also important to recognise that a legally binding NDA may be practically unenforceable. Businesses should therefore consider additional measures to prevent potential buyers from accessing or misusing valuable commercial information.
Finally, while NDAs have a wide range of uses beyond business sales, care must be taken when imposing onerous confidentiality obligations on individuals as those might be unlawful.
Insolvency Coffee Break Briefings
Thank you for reading the summary for this Coffee Break Briefing. You can watch the full, detailed webinar here. If you have any questions after reading this article, please don’t hesitate to get in touch with our bright and experienced team. Call us on 01202 499255, or fill in the form at the top of this page, for a free initial chat.
Malcolm’s next Coffee Break Briefing will take place on Monday 7 December 2026, when he will discuss Legalese.
Comments