A due diligence request list is the buyer's itemized list of documents and questions. Sellers answer it fastest by mirroring its numbering in the secure data room index, tracking every item in one register, answering with folder references instead of email attachments, and releasing sensitive items in stages by bidder group.
The request list arrives soon after a letter of intent or a second-round invitation, and it is usually long. How you handle it shapes the pace of the whole deal. A seller who answers from an organized room looks prepared and keeps control. A seller who answers by email loses track of what was sent to whom. This guide sets out a seven-step workflow for sellers, built around the secure data room.
Best overall: Read the Papermark review
Papermark is best for sellers answering a due diligence request list from one organized room, with granular folder permissions, page-level analytics that show whether bidders opened each answer, and audit logs. The Data Rooms plan is $99/month on annual billing.
What a due diligence request list looks like
Most request lists are spreadsheets organized by workstream: corporate and legal, financial, tax, commercial, HR, IP and technology, cybersecurity, real estate, environmental and insurance. Each row is a numbered item with a description and often a priority. Larger buyers send separate lists from each advisor, which means overlapping requests phrased differently.
The list is not a contract. Some items will not apply, some will be too broad and some will ask for documents that do not exist. Part of the seller's job is to respond to every item, even if the answer is "not applicable" or "see 3.2.1", so the buyer cannot later say a question went unanswered.
Workstream-specific lists are covered in our checklists for financial, legal, HR, IP and technology, commercial and cybersecurity due diligence. This guide is about the process of answering the list as a whole.
Step 1: Prepare the secure data room before the list arrives
The best time to answer a request list is before you receive it. Build the room against a standard checklist for each workstream, so that when the buyer's list arrives most items map to documents that already exist. The remaining items are the ones that genuinely need work.
Preparation also tells you where the gaps are. If a standard checklist asks for something you cannot produce, such as signed IP assignments or a reconciled cap table, you have time to fix it before a buyer sees the gap. Fixing problems on your own timetable is always cheaper than explaining them under a deadline.
- Build a numbered index covering every workstream you expect, using a data room index template
- Populate the core folders: corporate records, financial statements, material contracts, HR policies, IP schedules
- Set up permission groups before uploading: general bidders, shortlisted bidders, preferred bidder, clean team, advisors
- Turn on NDA gating and dynamic watermarking for the whole room
- Add a read-me at the top of each section explaining what is there and what is still to come
Step 2: Map the request list to your secure data room index
When the list arrives, go through it line by line and assign each item a data room reference, an owner and a release stage. Where the buyer's numbering differs from yours, keep your index stable and record the mapping in the tracker. Renumbering the room for each buyer creates confusion and breaks earlier references.
| Request item | Data room reference | Owner | Release stage |
|---|---|---|---|
| Fin 1.3: Monthly management accounts | 3.2 | Finance director | Round 2, all shortlisted bidders |
| Legal 2.7: Change-of-control contracts | 2.2 and contract schedule | General counsel | Round 2, shortlisted bidders' counsel |
| HR 4.1: Employee census | 5.2 (anonymized) | HR lead | Round 2; named data after signing |
| Comm 3.4: Pricing by customer | 4.4 | Commercial director | Preferred bidder or clean team |
| Tech 6.2: Penetration test reports | 7.3 summary, 7.4 full | CTO | Summary round 2; full to preferred bidder |
Step 3: Build a request tracker that everyone works from
The tracker is the single source of truth for the process. Keep it outside the buyer-facing room, shared only with your deal team and advisors, and update it daily during busy periods.
Assign one person to own the tracker. Owners of individual items update their own rows, but a single coordinator checks status, chases overdue items and confirms that every answer has been released to the right group. Without a clear owner, trackers drift out of date within days, and the room and the tracker start telling different stories.
- Buyer's item number and description
- Workstream and priority
- Internal owner and reviewer
- Data room reference, once uploaded
- Status: open, in progress, under review, answered, not applicable
- Permission group the answer was released to
- Date answered and any follow-up questions received
Steps 4 and 5: Answer with references and permission every response
Answer each item by uploading the document to the right folder and replying with its index number. Written answers to questions should also be uploaded as documents, not sent by email, so they carry the same watermarking and appear in the same audit log.
Then decide who sees each answer. In a competitive process, most sellers give all bidders at the same stage the same answers, which keeps the field level and avoids accusations of favoritism. Bidder-specific questions about the buyer's own plans are the exception. Sensitive items follow the staged release plan: anonymized first, named later, clean team where a competitor is involved.
Papermark handles this with granular folder and file permissions per group, NDA gating, dynamic watermarking and page-level analytics. The analytics show whether a bidder actually opened the document you referenced, which helps when the same question comes back a week later.
Hypothetical scenario: Tidewater Logistics works through its request list
Tidewater Logistics is a hypothetical regional freight broker that has signed a letter of intent with a private equity buyer. The buyer's legal, financial and IT advisors each send their own request list, and together they run to several hundred items, with plenty of overlap.
Tidewater's CFO consolidates the three lists into one tracker and maps each item to the existing data room index. Because the room was built before the process launched, most items already point to an uploaded document. Duplicate requests are linked to the same reference, so the team answers each underlying question once.
The remaining open items are assigned to owners with target dates. Each morning the deal team reviews the tracker, and the company's counsel approves uploads in batches. Customer contracts with rate schedules are released to the buyer's counsel only, view-only.
Two weeks in, the buyer's accountants ask again for the carrier payment terms. The analytics show that the referenced document was opened by the buyer's lawyers but never by the accountants, who were in a different permission group. The CFO adds the accountants' group to that folder, replies with the reference, and the item is closed the same day.
When the supplemental list arrives, Tidewater adds it to the same tracker under a new round, keeping the record complete.
Steps 6 and 7: Handle follow-up lists and close out the secure record
Every first list produces a supplemental list. Treat it as a new round in the same tracker rather than a new spreadsheet, and link follow-ups to the original item so the history of each question is visible.
As signing approaches, close out the record. Confirm every item has a status, every answer has a reference and every document is in the room rather than in an email thread.
- Log each supplemental request against its original item number
- Upload current trading updates on a regular schedule as the process runs
- Reconcile the tracker against the room index before signing
- Archive the room, the index and the audit log as of signing
- Give counsel a copy of the archive for the disclosure record
Common mistakes when answering a due diligence request list
- Answering items by email attachment instead of from the room
- Renumbering the data room to match each buyer's list
- Leaving items unanswered instead of marking them not applicable
- Running separate trackers for each advisor's list, so duplicates are answered inconsistently
- Uploading documents without advisor review
- Releasing sensitive items to all bidders because they appeared on one buyer's list
- Forgetting to archive the room and audit log at signing
More on due diligence checklists
Part of the Best virtual data room for due diligence cluster.
- Financial Due Diligence Checklist: What Sellers Put in the Secure Data Room10 min read
- Legal Due Diligence Checklist: Building and Permissioning the Secure Data Room10 min read
- HR Due Diligence Checklist: Employee Records in a Secure Data Room10 min read
- IP Due Diligence Checklist: Protecting Patents, Code and Tech Files in a Secure Data Room10 min read
- Commercial Due Diligence Checklist: Customer and Pricing Data in a Secure Data Room10 min read
- Cybersecurity Due Diligence Checklist: Preparing a Secure Data Room for Security Review11 min read
Next steps
Best virtual data room for due diligence
The hub guide to choosing a secure data room for a diligence process.
Due diligence data room checklist
The master checklist that ties every diligence workstream together.
Data room index template
A numbered index to map request list items against.
How to organize a secure data room
Folder structure principles that make request lists easier to answer.
Financial due diligence checklist
The financial workstream checklist for sellers.
FAQ
What is a due diligence request list?
It is the buyer's itemized list of documents and questions covering every diligence workstream, usually sent as a spreadsheet after a letter of intent or second-round invitation. The seller responds item by item, typically by pointing to documents in the data room.
How long does it take to answer a request list?
It depends on how much was prepared in advance. Sellers who built the data room before launch can answer most items quickly by reference. The rest depends on how many new documents and analyses need to be prepared.
Should every bidder get the same answers?
In a competitive process, generally yes for bidders at the same stage. It keeps the process fair and avoids disputes. Sensitive items still follow the staged release plan, and bidder-specific questions can be answered to that bidder only.
Should the request tracker be in the data room?
Keep the working tracker in a separate space shared with your deal team and advisors, because it contains internal notes and owners. Some sellers share a buyer-facing version with status and references only.
What if a requested document does not exist?
Say so in the tracker and in your response, and explain why if helpful. Do not create documents just to fill a request without your advisors agreeing that it makes sense.
How do I deal with overlapping requests from different advisors?
Consolidate all lists into one tracker, link duplicates to a single data room reference and answer each underlying question once. This keeps answers consistent and saves time.
Why archive the data room at signing?
The archive, together with the index and audit log, is the record of what was disclosed to the buyer. It may matter if a warranty claim arises after closing, so counsel usually keeps a copy.