Tech Exit Series – Preparing a Data Room

Orrick's Tech Exit Series suggests tips for tech companies looking towards an exit. Our market-leading London M&A and Private Equity team writes instalments in the series with contributions from specialists across our broader practice.

When selling a company, one of the most important steps is to create a well-organised and comprehensive data room. A data room is a secure, online repository where a company stores key documents and information about the company. It then shares that information with potential buyers and other parties in the transaction.

Here are seven steps companies should take to set up and maintain a data room for a potential acquisition:

1. Set up a data room early.
2. Follow guidelines on what information to include – and how to structure it.
3. Protect the data.
4. Ensure accuracy.
5. Consider creating a "clean room" for potential buyers in your sector.
6. Maintain confidentiality and security.
7. Prepare for follow-up questions.

In More Detail: Setting Up and Maintaining a Data Room

1. Set up a data room early.

The M&A process takes time, so we recommend establishing the data room early. This allows you to identify and rectify issues before a potential buyer carries out due diligence. If you have prepared a data room for a financing round, you should keep the information stored there updated.

In many cases, access to a data room is provided in two stages:

• You may provide initial information - particularly key financial data - to a potential buyer or to multiple bidders to allow them to make an informed judgement on valuation.
• You would typically grant a buyer comprehensive access once exclusivity has been granted, usually while the parties sign a term sheet or letter of intent. However, in some competitive situations, a potential target may allow multiple bidders to carry out due diligence and negotiate documentation as part of a managed process.

2. Follow guidelines on what information to include – and how to structure it.

You should:

• Organise the contents of a data room in a logical and user-friendly manner.
• Adopt a consistent and descriptive file naming and numbering convention.
• Label and number folders and subfolders so that documents or groups of documents can be easily cross referenced later.

Due diligence questions from a potential buyer (or your advisors) are typically far more extensive in a merger or acquisition than during equity financing rounds. If a prospective buyer has provided a list of questions, consider structuring your files and folders to follow the structure of these questions.

Typically, documents are grouped into categories such as:

• Tax: Returns and filings, assessments and audits, correspondence with tax authorities, tax credits and incentives documents and correspondence.
• Commercial: Business and strategy plans, sales and marketing materials, customer information, supplier and customer agreements, product information and operational data.
• Financial: Statutory accounts, audited financial statements, management accounts, budget and financial projections and debt or credit agreements.
• Insurance: Policies, details of claims and correspondence with insurers.
• Technical: Product specifications, software details and documentation, source code development records, IT infrastructure and cybersecurity details.
• HR: Employee and contractor information, payroll records and benefit plans.
• Legal: Constitutional documents, shareholders' agreements, statutory books and records, capitalisation tables, structure charts, material contracts, intellectual property documentation, details of disputes, employment agreements, real estate documents, environmental assessments and data privacy policies.

3. Protect the data.

In M&A transactions, buyers will often ask for information containing personal data, which is broadly defined as any information relating to an identifiable individual. This will include HR information about employees, as well as shareholder data in cap tables and registers, information relating to customers and suppliers and even signatory and witness information on historic contracts.

Generally, a target should enter into a data sharing agreement with each bidder, especially when sharing information outside the UK and EU. This agreement will:

• Set out the parties' obligations regarding shared data.
• Define shared data and the purposes for which it may be shared.
• Outline security measures and protocols to safeguard data integrity.
• Detail steps to follow in a security incident and any remedies.

Where the data is being transferred internationally, an agreement may need to contain standard contractual clauses prescribed by the GDPR.

Even with a data sharing agreement in place, you should keep any shared personal data to a minimum. You should take particular care when considering whether to share special categories of personal data, such as information about an individual's race, ethnicity, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation.

You should remove any personal data that does not need to be shared before the other party gains access. Some data room providers leverage artificial intelligence tools that automatically redact personal data, saving the time and expense of having to manually redact documents.

The buyer will eventually require access to any personal data relating to employees to prepare for the post-acquisition integration. However, a target company should only share this data once it is sufficiently certain that the deal will happen.

4. Ensure accuracy.

The buyer and its advisors will scrutinise information in the data room, so it is important to ensure that all documents are accurate, up-to-date and complete. Inaccurate or missing information can delay and potentially jeopardise a deal. As a potential target, you should:

• Review corporate and financial documents for accuracy and consistency.
• Update outdated information.
• Ensure that all contracts and agreements provided are fully executed, dated, up to date and not expired.
• "Flatten" any PDF documents that has been signed electronically. That will ensure that metadata stripping software does not remove signatures.

5. Consider creating a "clean room" for potential buyers in your sector.

For a potential buyer, particularly a trade buyer, that already participates in your sector, you may want to consider establishing a "clean room" – a folder or folders containing competitively and/or commercially sensitive information accessible only to a limited group of individuals on the buy-side (often referred to as the "'clean team"').

The clean team may include advisors for the buyer or individuals from the buyer's team. The clean team should not include key executives from the buy-side (such as those involved in operational, procurement and/or marketing functions). A separate agreement will usually set out the basis on which the clean team can share information from the clean room with other representatives of the buyer.

A clean room is most commonly used in deals that raise competition or antitrust questions. However, this structure may also be used to maintain the confidentiality of highly sensitive information, such as trade secrets or proprietary technology.

6. Maintain confidentiality and security.

Confidentiality is paramount in any M&A process.

You should use a professionally hosted secure data room that offers robust security features such as encryption, two-factor authentication, activity tracking and access controls. Such solutions offer a better and more secure user experience than free multi-purpose solutions such as Google Drive. A professional site will typically:

• Have a built-in indexing function – particularly helpful for tracking documents added to the data room later.
• Offer an integrated Q&A function allowing parties to set question limits and direct questions to specific team members.
• Leverage artificial intelligence tools. It's imperative that your team is trained to use these tools.

7. Prepare for follow up questions.

A potential buyer with access to the data room will likely have follow up questions or request additional information.

Using a professionally hosted data room platform may allow for these follow up questions to be integrated into the Q&A function. Designating a point person or team to handle additional follow up questions from the buyer will ensure a smooth process.

You should regard a data room as dynamic until it is closed, usually a day or so before the signing of any definitive documents.

Want to know more?

A comprehensive and well-structured data room can significantly streamline the due diligence process, minimising advisor fees and ensuring a buyer has the information needed to make an informed decision. Our London M&A and Private Equity team are well-equipped to recommend suitable data room solutions and assist with populating and structuring the site. If you would like to discuss your exit process, please contact James Connor, Katie Cotton and Dan Wayte.