How to Keep Your Sale Confidential and Protect Sensitive Information.

Customer and supplier data

Where an information leak does occur despite these controls, containing the resulting rumours among staff and suppliers is a distinct problem covered in managing sensitive information during a sale.

Named customer lists, contract terms and volumes are among the most damaging pieces of information if they reach a competitor posing as a buyer. Early stage materials should describe customer concentration and sector spread in general terms, for example the proportion of revenue from the largest client band, without naming individual customers. Full customer detail is released only once a buyer has signed an NDA and progressed to a serious, exclusive stage of negotiation, and even then it is often shared in a controlled data room rather than as an exportable document.

Pricing and margin information

Detailed pricing schedules and gross margin by product or customer reveal exactly how a business makes money, information a competitor could use regardless of whether they complete a purchase. This data is typically held back until due diligence, presented in aggregated form initially, and only broken down in full once exclusivity has been granted and the buyer's intent has been tested.

Contracts and key agreements

Supplier and customer contracts often contain confidentiality clauses of their own, meaning they cannot always be shared even with a signed NDA in place without breaching the terms of the underlying agreement. Reviewing contracts for these restrictions before a sale process begins avoids a situation where a buyer requests documents that legally cannot be disclosed, which can stall due diligence at a late stage. Where possible, redacted versions covering the commercial terms relevant to the buyer, without exposing unrelated confidential clauses, are a practical middle ground.

Intellectual property

Patents, trademarks, proprietary software and trade secrets need particular care because, unlike financial data, their value can be permanently damaged by disclosure to the wrong party even if no deal results. Registered IP details can generally be shared once ownership is confirmed, but unregistered know-how, source code or product formulations should be described functionally at first, with full technical detail reserved for a later stage under NDA and, where appropriate, a separate technical confidentiality agreement.

Staff and payroll data

Individual salaries, personal staff details and organisational structure are sensitive both commercially and under data protection law. Aggregated headcount and total payroll cost figures are generally sufficient for early stage discussions; individual employee data should only be shared once genuinely necessary, for example during formal due diligence into contracts and pension arrangements, and should be handled in line with data protection obligations rather than sent as an unrestricted spreadsheet.

Sequencing disclosure by category, rather than sharing a full information pack at the first sign of interest, is the most effective way to protect sensitive information while still giving a serious buyer what they need to progress. The legal foundation for this approach is covered in the guide to confidentiality and NDAs, and the practical mechanics of controlling disclosure once buyers are engaged, including data room structure, are addressed in how to handle confidentiality during the sale process.

Advisers and data room access controls

Beyond deciding what to share, controlling how it is shared matters just as much. A data room with watermarked documents, view-only access and a log of who has viewed which file gives a seller visibility over exactly what a buyer's team has accessed, and provides a clear record if information is later found to have been misused. Access levels should be reviewed and tightened again if a buyer withdraws or a process ends without a deal, since old credentials left active are a common and avoidable source of leaked information.

Wider context on confidentiality obligations and market practice is available in the confidentiality archive.