A virtual data room is a secure online workspace where a company shares confidential documents with the outside parties examining it, with every view, download and question logged.
Picture a family-owned engineering business in the West Midlands, turnover around £12m, agreeing heads of terms with a trade buyer from the North West. Within a week the buyer’s solicitors send an information request list running to 300 items, and the buyer’s accountants want three years of management accounts, VAT returns and the payroll summary. The seller’s finance director could email it all. Instead, the corporate finance adviser opens a data room, the sell-side solicitors arrange the files under a numbered index, and the buyer’s team logs in to a room where they can read, but not freely forward, everything they asked for.
That, in short, is the job.
What does a virtual data room actually do in a UK deal?
It does four things that ordinary file sharing does badly.
First, it controls access at a fine grain. A seller running an auction might let three bidders into the commercial folders but hold back customer pricing until one of them is granted exclusivity. Permissions are set per group and per user, and they can be changed in seconds when a bidder drops out.
Second, it records everything. The room logs every login, every document opened and for how long, every download and every print. That log has two uses. Commercially, the adviser can see which bidder is genuinely working through the tax folder and which has not logged in for a fortnight. Legally, it is evidence of what the buyer had the chance to read before signing, which supports the general disclosures in the disclosure letter.
Third, it protects the documents themselves. Dynamic watermarks stamp each page with the viewer’s name and the time, which discourages screenshots and makes a leak traceable. Document rights control can stop printing or downloading, or withdraw access to files already downloaded.
Fourth, it organises the conversation. Due diligence in England and Wales runs on enquiries: lists of questions from the buyer’s solicitors and accountants. A Q&A module ties each question to a document, routes it to the right person on the sell side and keeps the answer on record, instead of scattering it across thirty email threads.
Who works inside a UK deal room
Which UK transactions use a data room?
Almost any deal where one party must inspect another’s confidential records before committing money. The table sets out the common ones and what tends to be most sensitive in each.
| UK transaction | Who usually opens the room | Typical life of the room | Most sensitive material |
|---|---|---|---|
| Private company share sale | Corporate finance adviser or sell-side solicitors | 3 to 6 months | Customer contracts, staff costs, tax history |
| Asset sale or hive-out | Seller’s solicitors | 2 to 4 months | Contracts to be assigned, TUPE information |
| SEIS or EIS fundraising | The company’s founders or finance lead | 1 to 4 months | Cap table, advance assurance, IP ownership |
| Public takeover under the Takeover Code | Target’s financial adviser | Weeks, under a strict timetable | Price-sensitive inside information |
| AIM admission | Nominated adviser and the company | 3 to 6 months | Verification notes, working capital model |
| Sale out of administration | The administrators | Days to a few weeks | Asset lists, leases, employee data |
| Commercial property sale | Seller’s property solicitors | 1 to 3 months | Title, leases, rent schedules, CPSE replies |
Our sector guides go deeper on each, including selling a business, SEIS and EIS fundraising and administration and insolvency.
A public takeover is the strictest case. The Takeover Code expects information given to one offeror to be given, on request, to another bona fide offeror, so the target’s adviser needs a clean record of what each bidder received. The Takeover Panel publishes the Code in full.
What goes into a typical UK data room?
The exact list follows the buyer’s request, but the bones of a UK private company room are predictable. Most indexes run to ten or twelve top-level folders.
Corporate. Certificate of incorporation, articles of association, the statutory registers (members, directors, persons with significant control), board and shareholder minutes, and copies of the filings at Companies House. Buyers’ solicitors compare the company’s own registers with the public record on the Companies House service, so any gap between the two is better found by the seller first.
Finance and tax. Statutory accounts, management accounts, budgets, the debt schedule, corporation tax computations, VAT returns, PAYE records and correspondence with HMRC, including any enquiries or time-to-pay arrangements.
Commercial. Key customer and supplier contracts, framework agreements, terms and conditions, and anything with a change of control clause, which a buyer will flag immediately.
Employment. Contracts and handbooks, pension scheme details, any collective agreements, and the staff list. On an asset sale this folder also carries the TUPE information the buyer needs about transferring employees.
Property. Title documents, leases, licences, rent reviews, and the replies to standard commercial property enquiries.
Intellectual property and IT. Registered trade marks and patents, assignments from founders and contractors, software licences, and information security policies.
Disputes and compliance. Claims, threatened litigation, regulatory correspondence, insurance policies and claims history.
A folder for Q&A attachments usually sits at the end, holding documents produced in answer to enquiries so the index stays in step with what was disclosed.
How is a data room different from SharePoint, Dropbox or email?
General file-sharing tools are built for colleagues who trust each other. A data room is built for counterparties who do not, and the differences show up in the details.
| What you need on a deal | Virtual data room | Shared drives (SharePoint, Dropbox) | Email attachments |
|---|---|---|---|
| Folder access set per bidder group | Yes | Partly, through manual sharing links | No |
| Watermark with the viewer’s name | Yes | Rarely, or on higher plans only | No |
| Report of who opened which file and for how long | Yes | Basic activity only | No |
| Q&A tied to documents | Yes | No | No |
| Withdraw a file after download | Often, through document rights control | No | No |
| Index you can attach to the SPA | Yes, numbered automatically | Manual | No |
None of this means a small, friendly deal must use a data room. If a business is selling to its management team and the buyer already knows every contract, a tidy shared folder may be enough. The case for a room grows with the number of outside parties, the sensitivity of the material and the chance of a dispute afterwards.
How does the room fit the UK deal timetable?
The room tracks the familiar UK sequence from first contact to completion, and its contents change at each stage.
Before heads of terms. Bidders sign a non-disclosure agreement and receive an information memorandum. Some advisers open a limited room here with headline financials and a business overview; many wait.
After heads of terms. Once a buyer has exclusivity, the full room opens. The buyer’s solicitors issue their enquiries, the accountants begin financial and tax due diligence, and the Q&A log starts to fill. This is when the room does most of its work, usually over six to twelve weeks on a mid-sized private sale.
Negotiating the SPA. Diligence findings feed the share purchase agreement: price adjustments, specific indemnities, warranties. In parallel, the sell-side solicitors draft the disclosure letter. A common approach is to disclose the whole room generally, with the index attached, and then make specific disclosures against individual warranties.
Completion. The room is frozen, the index is finalised and an archive copy, often on an encrypted drive, goes to both sides’ solicitors as part of the completion bible. Access is then closed.
That last step is easy to forget, and it matters. If a warranty claim arrives eighteen months later, the archive is how each side proves what was and was not disclosed.
What does UK GDPR mean for what you upload?
A data room on a UK deal almost always contains personal data: employment contracts, payroll summaries, director details, perhaps customer records. Uploading it is processing under UK GDPR and the Data Protection Act 2018, and the seller remains responsible for doing it lawfully.
In practice the seller is usually the controller, and the data room provider acts as its processor under a written agreement. The ICO’s guidance on UK GDPR sets out the duties that follow, including data minimisation: share only what the buyer needs at that stage.
On a share sale that tends to mean anonymised staff lists early (role, salary, start date, no names), with named contracts only for senior people and only once a preferred buyer has exclusivity. Health information, disciplinary records and anything else in the special categories should stay out of the room unless there is a specific, documented reason.
What security should a UK buyer’s IT team expect?
Larger buyers, banks and listed groups send supplier security questionnaires, and the data room will be on the list. The certifications they look for most often are ISO 27001 and SOC 2. Some UK public-sector and regulated buyers also ask whether suppliers hold Cyber Essentials, the scheme run by the National Cyber Security Centre, though it certifies an organisation’s basic controls rather than a product.
Beyond certificates, the controls worth checking are practical ones: two-factor login for every external user, watermarking that cannot be switched off by a viewer, an audit trail you can export at the end, permission changes that take effect immediately, and a clear deletion process when the room closes. Single sign-on matters mainly to large corporate teams who want their own staff to log in with company credentials.
Most specialist providers cover the core list. Where they differ is in the extras: built-in redaction, AI tools for sorting and summarising documents, mobile apps, APIs and deployment options. Our provider reviews list what each one offers.
How do you open a data room for a UK deal?
The mechanics are quicker than most sellers expect. The preparation behind them is not. A clean room takes weeks of gathering documents; the software itself takes an afternoon.
Agree who owns the room
Decide whether the corporate finance adviser, the sell-side solicitors or the company administers it, and who signs off each upload. One owner avoids duplicate folders and half-finished permissions.
Build the index from the buyer's request list
Mirror the categories the buyer's solicitors will use: corporate and Companies House records, commercial contracts, employment, property, IP, IT, tax, litigation, finance. Number the folders so the index can be attached to the disclosure letter.
Clean the documents before upload
Remove drafts, duplicates and anything privileged. Anonymise staff data for the early stage. Check that statutory registers and filings match what Companies House shows.
Set groups and permissions
Create one group per bidder plus their advisers. Decide which folders each group sees, and whether files are view-only, printable or downloadable. Turn on watermarking and two-factor login for everyone.
Test the buyer's view
Log in as a test user in a bidder group and check that hidden folders really are hidden. This single step catches most permission mistakes.
Open Q&A with clear rules
Tell bidders how to submit enquiries, how many they can raise and the expected turnaround. Route questions to named people on the sell side.
Close and archive at completion
Freeze the room, export the full index and audit trail, issue the archive to both sides' solicitors and switch off access.
What does a data room cost in pounds?
Most specialist providers quote on request, so the honest answer depends on the size of the deal, the number of users, the storage and how long the room stays open. Among the providers in our table, the published entry prices start at $149/mo (approx. £115) for Ellty and run to $299/mo (approx. £230) for CapLinked. Those figures are indicative, may exclude VAT and should be confirmed with the provider.
The bigger cost risk is duration. A sale that drifts from four months to nine doubles the bill on a monthly plan, so budget for the long version of the timetable, not the hopeful one. Our full guide to data room costs in the UK works through budgets by deal type.
See how 14 providers compare on security, deal tools, ease of use, value and support for UK deals.
View the UK rankingHow should you choose between providers?
Start from the deal, not the brochure. A three-bidder private sale needs strong permissions, Q&A and a clean audit trail. A takeover needs a provider and an adviser comfortable with tight timetables and insider controls. A SEIS round needs something investors can open on the first try without a call to support.
Our ranking weights five criteria for UK use: security and UK GDPR support at 30%, deal tools at 25%, ease of use at 20%, value for money at 15% and support at 10%. On that basis Ellty, iDeals and Datasite currently sit at the top, with Ansarada, Intralinks and Firmex close behind. The scores are editorial and the reasoning is on our methodology page.
Where do UK sellers most often go wrong?
Three mistakes come up again and again, and none of them is about software.
The first is opening too late. Sellers wait for heads of terms before gathering documents, then spend the exclusivity period chasing missing leases and unsigned contracts while the buyer’s patience runs down. Starting the index two or three months before going to market costs little and shortens diligence considerably.
The second is over-sharing early. Putting named payroll data, full customer pricing and every board minute in front of five bidders at the first stage creates both commercial and UK GDPR risk for very little gain. Stage the release.
The third is treating the room as a dump. A buyer faced with 4,000 unindexed files will raise more enquiries, not fewer, and the disclosure position gets murkier. A clear, numbered index with short descriptions is worth more than another thousand documents.
And whichever provider you pick, use the free trial where one is offered. Build a small version of your real index, invite a colleague as a bidder and see whether the experience holds up from the other side.
Questions people ask
Is a virtual data room the same as a deal room?
The terms overlap. In UK practice a data room usually means the secure document repository used for due diligence, while some providers use deal room to describe a wider workspace that also manages tasks and pipeline. For a sale or raise, the document controls are what matter.
Do I need a data room to sell a small UK company?
Not always. A sale to management or to a single buyer who already knows the business can run on a well-organised shared folder. Once there are several bidders, sensitive commercial data or a real chance of a later warranty claim, the audit trail and permissions are worth paying for.
Who sets up the data room in a UK sale?
Usually the corporate finance adviser or the sell-side solicitors, working with the company's finance team. The seller pays in most cases and approves what goes in.
Does the data room become part of the disclosure letter?
Often, yes. Sellers commonly make a general disclosure of the whole room with the index attached, then specific disclosures against individual warranties. Buyers push back on how wide that general disclosure is, so agree it during SPA negotiations.
Can buyers download documents from a data room?
Only if the administrator allows it. Each folder or file can be view-only, printable or downloadable, and many rooms can watermark downloads and revoke access to them later.