Selling a company confidentially: a leak-prevention protocol

Confidentiality in a company sale is not guaranteed by one NDA: it is protected by limiting who knows about the transaction, what each person receives and how long access remains open. The realistic objective is not zero risk. It is to stop a prospective buyer from identifying the company or using sensitive information before demonstrating genuine interest and capacity.

A phased confidentiality protocol

Stage	Reasonable information	Main control
Preparation	Data map, buyer list and materials not yet distributed	Small internal team, code name and separate permissions
Initial approach	A sufficiently anonymised teaser	Exclude combinations of facts that identify the company
After the NDA	Identity, aggregated financial information and memorandum	Purpose limitation, authorised recipients and download logs
Indicative offer	Redacted contracts, customer concentration and gradual operating detail	Folder-level access and questions channelled through the adviser
Exclusivity and confirmatory review	Identifying information needed to complete due diligence	Need-to-know, a clean team where appropriate and access removal at the end

The sequence must be adapted to the sector and the buyer. A teaser does not have to wait for an NDA if it is genuinely blind, but the NDA should precede disclosure of identity and information capable of causing competitive harm. The guide to designing the whole confidential sale process covers the wider organisation; this article focuses on leak controls.

What a blind teaser must hide

Removing the name and logo is not enough. A combination of town, exact revenue, headcount, certifications, largest customer or founding year can identify an SME within minutes. Before circulation, test whether someone familiar with the industry can reidentify the company.

• Use reasonable ranges for scale and geography when exact data would identify.
• Describe customers by segment rather than by name.
• Hold back unique milestones, products or certifications until a later stage.
• Give each recipient a code and preserve the version sent.

What an NDA does—and does not—do

An NDA defines protected information, permitted purpose, authorised recipients, exceptions, duration and return or destruction. It may also restrict direct contact with employees, customers and suppliers. It cannot physically prevent a leak or make every restriction enforceable: non-solicitation and non-compete terms need separate review for scope and legality.

Spain’s Trade Secrets Act 1/2019 requires, among other elements, reasonable steps by the holder to keep information secret. Classifying documents, restricting recipients, logging access and removing permissions help both prevention and evidence.

What changes when the buyer is a competitor

A competitor may need data to value the business, but should not receive unfiltered future prices, live quotations, customer-level strategy, disaggregated costs or plans that are unnecessary for the transaction. The European Commission’s Horizontal Guidelines explain the competition risks of information exchange and the use of restricted teams or clean teams.

Options include aggregation, anonymisation, historical information, delayed customer identification or analysis by advisers who do not make day-to-day commercial decisions. A clean team is not merely a label: its members, permitted inputs, aggregated outputs and ban on passing sensitive data to the operating team must be defined.

Personal data and employee communication

Named payroll, appraisals, medical leave and disciplinary data should not be open by default. The GDPR requires a lawful basis, purpose limitation, data minimisation, security and limited retention. Aggregated or pseudonymised data is normally more appropriate in early stages.

There is also no universal rule that employees are told “after signing”. In a share sale the same company remains the employer; a transfer of an economic entity that retains its identity may fall under Article 44 of the Spanish Workers’ Statute, with information and, where applicable, consultation duties. Labour communications must follow the actual structure of the deal.

How to respond to a suspected leak

1. Contain: suspend the affected access without deleting evidence.
2. Preserve: retain logs, emails, versions and the list of people with access.
3. Classify: identify trade secrets, personal data, competitively sensitive information and contractual issues.
4. Decide: coordinate legal counsel, data leads and management before accusing or communicating.
5. Correct: change permissions, narrow the perimeter and document the response.

If personal data may be compromised, the assessment must consider GDPR notification duties. If the source has not been established, a premature accusation can compound the harm.

Checklist before opening the data room

• Document inventory and sensitivity classification.
• A named owner who approves each access level.
• An NDA signed by the correct entity and identified recipients.
• Separate folders, time-limited permissions and activity logs.
• Minimised personal data and redacted contracts where possible.
• A specific protocol for competitors and external advisers.
• An exit plan: revoke, return or destroy while preserving necessary evidence.

The sell-side mandate should allocate responsibility for buyer screening and information release. Due diligence can be rigorous without giving everything to everyone on day one.

Sources consulted

• Spanish Official Gazette: Trade Secrets Act 1/2019.
• EUR-Lex: General Data Protection Regulation.
• European Commission: Horizontal Cooperation Guidelines.
• Spanish Official Gazette: Workers’ Statute, Article 44.