Practical guide
These points support an initial assessment. The decisive legal, tax, financial and operational questions depend on the business, the people involved and the chosen transaction structure.
Define confidential information and the permitted purpose
Describe the information covered, including written, oral, visual and data-room material, and state that it may be used only to evaluate and negotiate the proposed transaction. Consider whether the existence of discussions and the seller's identity are themselves confidential. Overly broad definitions can be hard to apply, while narrow definitions leave obvious gaps. The recipient should know which material requires protection without relying on every file being marked. The purpose clause also prevents confidential data from being used for competition, recruitment or unrelated investment decisions.
- cover relevant formats and the existence of negotiations
- state the evaluation purpose and prohibited uses
- use definitions that recipients can apply in practice
Identify permitted recipients and responsibility for advisers
Buyers may need to involve directors, employees, lenders, investors and professional advisers. Define which groups can receive information, require a genuine need to know and ensure they are bound by suitable obligations. The buyer should remain responsible for breaches by its representatives where appropriate. Competitors may require a clean-team arrangement so commercial decision-makers do not see sensitive pricing or customer details. Sharing with a financing source should not become a general right to circulate the seller's data beyond the people evaluating the transaction.
- limit access to named categories with a need to know
- bind advisers, investors and financing sources appropriately
- consider clean teams for competitively sensitive information
Set exclusions, compelled disclosure and contact rules
Common exclusions cover information already public, previously known, lawfully received from another source or independently developed, with suitable evidence requirements. If law or an authority compels disclosure, the recipient should notify the seller where legally permitted and limit the release. The NDA can also prohibit direct contact with employees, customers or suppliers unless the seller approves it. Non-solicitation or non-compete clauses go beyond pure confidentiality and require separate scrutiny for scope, duration and enforceability rather than being hidden inside a standard form.
- define exclusions and who must demonstrate them
- create a process for legally required disclosure
- regulate stakeholder contact and broader restrictions separately
Agree security, personal-data and deletion obligations
Require reasonable technical and organisational protection, prompt notice of suspected loss and compliance with data-room rules. Personal data should be minimised, redacted and processed for a legitimate transaction need; an NDA alone does not satisfy Swiss data-protection requirements. When discussions end, recipients may need to return or delete material and confirm completion, subject to legal, regulatory or backup exceptions. Those exceptions should not permit active use. Highly sensitive files may remain view-only or accessible to advisers rather than being downloaded by every member of the buyer team.
- apply security controls appropriate to the information
- minimise and lawfully handle personal data
- define return, deletion, backup and retention exceptions
Choose duration, remedies and governing terms carefully
Set a duration appropriate to the information, recognising that trade secrets may remain sensitive longer than ordinary financial data. Address governing law, jurisdiction and the availability of urgent relief without assuming that a remedy can undo reputational harm. Costs, no-obligation language and the seller's ability to stop disclosure should be clear. The NDA should also state that information is provided for evaluation and that representations are made only in the definitive agreement. Transaction-specific legal advice is important where parties, data or enforcement span multiple countries.
- match duration to the useful life of each information type
- review remedies, law and forum for the actual parties
- separate evaluation material from contractual representations
Sources and further information
Frequently asked questions
Should an NDA be signed before the company name is disclosed?
It can be appropriate when the identity itself is sensitive and the buyer has shown a plausible fit. The seller should still provide enough anonymous information for basic screening before demanding a complex agreement. Signing too early with every casual enquiry creates administration without meaningful protection; signing too late may reveal the company or sensitive figures without clear duties. The correct point is when company-specific information is needed for the next credible decision.
Can the buyer share information with a bank?
Only if the NDA permits financing sources or the seller gives approval, and access should be limited to people evaluating the financing. The bank may have its own confidentiality and regulatory duties, but those do not automatically satisfy the seller's agreed terms. Consider whether the bank needs identifiable customer or employee data at that stage. The buyer should track what is shared and ensure any external finance adviser or investor is also covered appropriately.
Does an NDA prevent the buyer from competing?
A confidentiality obligation prevents misuse or disclosure of protected information; it does not automatically create a general non-compete restriction. If the seller seeks limits on competition, solicitation or hiring, those provisions should be drafted and reviewed separately for legitimate interest, scope, duration and enforceability. A broad restriction hidden in a standard NDA can be disproportionate and may discourage credible buyers. Legal advice is particularly important when the candidate already operates in the same market.
What information should be deleted when talks end?
The agreement should cover files, extracts, notes and copies containing confidential information, subject to defined legal or regulatory retention and inaccessible backup exceptions. The recipient should stop using retained material and preserve its confidentiality. Personal data deserves particular attention because it should not be kept without need. A practical deletion process identifies repositories and team members, revokes data-room access and provides confirmation where required rather than relying on a general statement that everything was deleted.
Is a template NDA sufficient for every acquisition?
No. A template can start the discussion, but the parties, sector, competitive relationship, jurisdictions, personal data and planned recipients can change the risk significantly. A management buyer, direct competitor and financial investor may need different access rules. Review definitions, purpose, representatives, duration, contact restrictions, security, remedies and governing law for the actual transaction. The aim is a usable agreement that supports controlled diligence, not the longest possible list of generic clauses.