Due diligence is the part of a UK transaction where the buyer, investor or lender checks what it has been told. It happens on share sales, asset purchases, investment rounds, refinancings and joint ventures, and in every case the work is the same in shape: a list of questions from one side, a set of documents from the other, and a record of what was provided. A data room is where those three things meet.
This page covers diligence as a process. For the sale itself, see our pages on mergers and acquisitions and selling a business.
What due diligence covers in a UK deal
A buyer rarely sends one team. Its solicitors, accountants, tax advisers and sometimes specialist consultants each take a part of the business, and each reads only their part of the room. If the index is filed the same way they work, they find things quickly and ask fewer questions.
Eight workstreams, one room
- 1 Legal Articles, statutory registers, material contracts, disputes
- 2 Financial Statutory and management accounts, debt, working capital
- 3 Tax Corporation tax, VAT and PAYE filings, HMRC correspondence
- 4 Commercial Customer and supplier terms, pricing, pipeline
- 5 People Service agreements, pensions, employee information
- 6 IT and data Systems, cyber incidents, UK GDPR records
- 7 Property Title, leases, landlord consents
- 8 Regulatory Licences, permits, health and safety, environmental
One team per workstream reads its own folders, so file the room the same way.
datarooms.ukUK due diligence
The legal team will start with the constitution and the statutory registers, then move to material contracts and disputes. Financial diligence tests the statutory and management accounts, debt and working capital. Tax advisers want returns and HMRC correspondence for corporation tax, VAT and PAYE. Commercial, people, IT and data, property and regulatory work follow, with the weight of each depending on the business.
Who sees what, and when
Diligence is not one release of documents. Access widens as the buyer commits more money and more legal protection to the deal.
| Stage | Typical readers | What is open |
|---|---|---|
| Before an NDA | Prospective buyers | Teaser only, nothing in the room |
| After NDA, first look | Buyer’s deal team, lead adviser | Summary financials, structure chart, key contracts in summary |
| Heads of terms agreed | Solicitors, accountants, tax advisers | Full workstream folders, with sensitive files view-only |
| Confirmatory | Named specialists | Customer-level pricing, individual employee data, source documents held back earlier |
The final row is where most damage is done when it goes wrong. Customer names, salaries and anything competitively sensitive should only open once exclusivity is signed, and ideally only to advisers rather than the buyer’s operating team. If the buyer is a competitor, a clean team arrangement may be needed; our joint ventures page explains how that works.
Running the request list
The buyer’s request list is usually a spreadsheet with a reference for each question. Mirror its numbering in the index and in the Q&A module, so that an answer, the document that supports it and the original question can all be traced to the same reference. Route questions to the person who can answer them rather than to a single inbox at the seller, and set a rule for how long answers may take.
Answers matter as much as documents. In a UK share sale, the seller’s disclosure letter qualifies the warranties, and the documents and replies in the room are usually what the letter discloses against. A careless reply in Q&A can become part of the deal record. Our guide to replying to due diligence enquiries covers drafting answers in more detail.
Checking the room against public records
Buyers’ solicitors will check what the room says against what is on the public record. The most common source is Companies House: filed accounts, confirmation statements, registered charges and the register of people with significant control. If the room’s share capital or directors differ from the public filing, expect questions before anything else. Many buyers also check whether the company has paid the ICO data protection fee, which most organisations processing personal data must pay.
Diligence often means sharing employee and customer information. UK GDPR still applies: share only what the buyer needs at each stage, anonymise where you can, and ask the provider where data is hosted and accessed from. Our guide on UK GDPR in due diligence sets out a sensible approach.
Where diligence rooms go wrong
- Uploading everything on day one, then spending weeks explaining irrelevant files
- Folder names that make sense to the seller’s finance team but not to an outside lawyer
- Replacing documents without keeping the earlier version, which undermines the disclosure record
- Leaving the room open after a bidder withdraws
- Answering questions by email outside the room, so the record is incomplete
Budgeting a diligence room
The cost depends on how many teams read the room and for how long. A single buyer with a small adviser team can work in a monthly plan; a competitive process with several bidders and heavy Q&A traffic may justify an enterprise quote. Ask whether price depends on pages, storage, users or time, and check the cost of an archive copy at the end. Our cost guide compares the pricing models, and the providers page shows which rooms publish prices.
Questions people ask
How long does due diligence usually take in a UK deal?
For a private company sale, confirmatory diligence after heads of terms often takes several weeks to a few months. The quality of the room is one of the main things that moves that range.
Should the seller or the buyer set up the data room?
Usually the seller, or its adviser, because the seller controls the documents and wants one record of what was disclosed. Buyers sometimes run their own rooms internally to manage their advisers' findings.
Can we use shared drives instead of a data room for diligence?
For a very small deal it can work, but you lose page-level audit trails, view-only controls and a structured Q&A, which matter when the record of what was disclosed has legal weight.
What should we keep after completion?
An archive of the final room, the Q&A log and the audit trail, ideally on read-only media. It may be needed if a warranty claim is made later.