Practical guide
These points support an initial assessment. The decisive legal, tax, financial and operational questions depend on the business, the people involved and the chosen transaction structure.
Map the information and harm that require protection
Identify what could damage the company if disclosed too early: its identity, sale intention, customer names, prices, margins, employee data, technology, supplier terms or strategic plans. Consider who might act on that information and how easily an anonymous description could reveal the company. Then classify material by public, confidential and highly restricted stages. Confidentiality should protect a defined commercial purpose, not become a blanket excuse for giving buyers no evidence. The risk map also helps the seller decide which people must know internally and which can remain outside the process.
- classify identity, commercial, personal and technical information
- assess likely recipients and consequences of a leak
- define public, NDA-stage and restricted disclosure levels
Market the opportunity anonymously but specifically
An anonymous listing can state sector, broad region, business model, customer type, financial scale, team and handover without the legal name or exact address. Remove combinations of details that make the company obvious in a small market. At the same time, avoid descriptions so vague that every curious reader must ask for the identity. Use a controlled contact path rather than personal email or phone details. The first profile should help unsuitable candidates self-select out before any sensitive company-specific information is released.
- use a broad location and non-identifying commercial description
- retain enough facts for serious buyers to assess fit
- route enquiries through one controlled communication channel
Qualify candidates before expanding access
Ask who the candidate is, why the acquisition fits, what role they intend to take and whether financing is plausible. Verify the identity and authority of companies or advisers where appropriate. A signed NDA matters, but it does not make every recipient equally trustworthy or justify immediate access to all records. Release information in steps tied to clear decisions: anonymous screening, identity and summary figures, management discussion, indicative proposal and detailed due diligence. Maintain a disclosure log so that the seller knows who received each version.
- verify identity, rationale, capacity and authority
- tie each disclosure stage to a completed qualification step
- record recipients, files, versions and access dates
Use NDAs and data-room controls proportionately
The NDA should define confidential information, purpose, permitted recipients, security, compelled disclosure, duration and return or deletion. Highly sensitive data may require additional restrictions, redaction, view-only access or specialist review. Give advisers access only when they need it and are covered by the agreed obligations. Watermarks and logs can deter misuse but do not replace sound recipient checks. Swiss data-protection duties apply to personal data, so employee and customer records should be minimised and anonymised until identifiable information is genuinely necessary.
- define purpose, recipients, duration and deletion duties
- restrict highly sensitive files by role and need
- redact personal data and monitor data-room access
Plan internal and external communication before closing
Decide how employees, key customers, suppliers, lenders and other stakeholders will be informed, by whom and at which milestone. Some parties may need to provide consent before closing; others should hear only when the transaction is sufficiently certain. Prepare answers about continuity, roles, contracts and contact points. Communication should be truthful and coordinated without disclosing negotiation details unnecessarily. If a leak occurs, use an agreed response rather than improvised denials that later undermine trust. A well-planned announcement is part of the handover, not a marketing afterthought.
- map stakeholders, legal requirements and consent timing
- prepare messages, speakers and frequently asked questions
- define a response plan for rumours or premature disclosure
Sources and further information
Frequently asked questions
Can a company be sold without employees finding out?
The process can remain limited to a small group for a period, but permanent secrecy is rarely possible or desirable. Employees may need to support due diligence, and information or consultation obligations may apply depending on the transaction. The owner should plan timing and communication carefully, use need-to-know access and avoid public clues. Once the transaction becomes sufficiently concrete, a controlled internal announcement is usually safer than allowing employees to learn through rumours or external contacts.
Is an NDA enough to protect the seller?
No. An NDA creates contractual duties, but enforcement after a leak may not repair commercial harm. Protection also depends on candidate qualification, staged disclosure, redaction, secure systems, access logs and careful internal communication. The agreement should be clear and proportionate, yet the seller should still ask whether each recipient needs each document. The most effective control is often not disclosing highly sensitive information until the buyer has reached a stage where the need is genuine.
When can the buyer contact customers or employees?
Only with the seller's express agreement and under a coordinated plan. Unauthorised contact can reveal the sale, disrupt relationships and breach confidentiality or data-protection duties. If reference conversations are necessary, select the people, timing, questions and participants in advance. In many cases, commercial concentration and employee structure can first be reviewed through anonymised evidence. Direct contact may be reserved for a late stage when the transaction is credible and the potential benefit outweighs disruption risk.
How long should confidentiality obligations last?
Duration should reflect the nature and useful life of the information. Some commercial data becomes outdated quickly, while trade secrets may deserve protection as long as they remain secret. Personal data should not be retained simply because a long contractual term exists. The NDA should distinguish duration, deletion duties and any information that remains protected under law or professional obligations. A transaction-specific legal review is preferable to applying one arbitrary period to every category.
What should happen if confidential information is leaked?
Preserve evidence, identify the information and recipients, restrict further access and obtain legal and data-protection advice promptly. Assess whether affected people or authorities must be informed and activate the prepared communication plan. The seller may need contractual remedies, but immediate operational steps often matter more. Record the incident and adjust access controls. Avoid broad accusations before the facts are established, because an incorrect response can create additional reputational and legal problems.