Legal Due Diligence Checklist: Building and Permissioning the Secure Data Room

Buyer's counsel is looking for three things: proof that you own what you say you are selling, a map of the obligations the buyer will inherit, and any exposure that should be priced, indemnified or fixed before closing. Change-of-control clauses, unresolved disputes and gaps in the chain of title are the usual sources of trouble.

For the seller, the legal data room has a second job. Many purchase agreements treat documents fairly disclosed in the data room as disclosed against the warranties. That makes the room part of your legal protection, provided the documents were actually available to the buyer and you can prove it. A clean folder structure, a dated index and a complete audit log are what make that argument possible later.

Start the legal section with your own counsel, not with a buyer's request list. Your lawyers will know which documents are missing, which contracts need consents and which issues should be disclosed with an explanation rather than left for the buyer to discover.

Number the legal section so its folders line up with the disclosure schedules your counsel will draft. When the schedule says a contract is disclosed, it should be a simple matter to point to the exact index number where that contract sits. The table below is a practical starting point.

Create permission groups for bidders, for bidders' counsel and for any clean team, then switch folders on by group as the process moves. Papermark supports this with granular folder and file permissions, NDA gating before the first document opens, and an audit log that records every view by named user, which becomes evidence of disclosure if a warranty claim ever arises.

Some legal documents create risk simply by being shared. Ask your counsel to review each of these categories before they are uploaded, and decide the access level document by document rather than folder by folder.

Brightwater Analytics is a hypothetical B2B software company selling to a strategic acquirer. Its general counsel starts by asking outside counsel for a gap review against the checklist above, three months before the process launches.

The review finds two issues. First, a handful of early customer contracts contain change-of-control clauses that let the customer terminate on a sale. Second, a share issuance from several years ago was never properly approved by the board. Counsel drafts a ratifying resolution for the share issuance and prepares a contract schedule that flags every change-of-control clause, so the buyer sees the issue framed by the seller rather than discovered in a document review.

Brightwater then sets up the legal section with three groups. General bidders see corporate records and a redacted contract summary. Shortlisted bidders' counsel see the full contracts. Because the strategic acquirer competes with Brightwater in one product line, contracts for overlapping customers sit in a clean-team folder visible only to the acquirer's outside counsel.

When the purchase agreement is negotiated, Brightwater's counsel relies on the dated index and the audit log to show which contracts the buyer's lawyers opened, and when. That record supports a fair disclosure clause and narrows the warranty package. It also means the change-of-control issue is handled as a closing condition with agreed customer outreach, rather than as a late price discussion.

After the first review, buyer's counsel sends a supplemental request list. It usually narrows to the issues that will shape the purchase agreement: consents needed to close, disputes that might need a specific indemnity, and any gap in title or authority. Expect the following.

Answer each item by uploading the document into the numbered folder and replying with its index reference. Avoid answering by email with attachments, because a document sent outside the room is harder to prove as disclosed and is not covered by the room's watermarking or audit log.