Mergers and acquisitions Virtual safe that decides the fate of the transaction – VDR in M&A

Where do mergers and acquisitions really happen? Not in conference rooms, not just on the front pages of newspapers, but above all in the privacy of digital Virtual Data Rooms.

When in 2024 Dr. Marek Konieczny, a cardiologist and internal medicine specialist, founder of Ko-Med Centra Kliniczne clinical centers, was selling his company to Velocity Clinical Research, and when VeloBank found a new owner among foreign investors, the key stages of these transactions took place in data rooms (the first of these transactions with the use of Fordata VDR). The speed and success of finalizing these high-profile acquisitions depended to a large extent on the efficiency of VDR management.

The US M&A market, the largest in the world in terms of transaction value, saw a 9% year-over-year increase in M&A transaction value in 2024, reaching $1.7 trillion. This was primarily due to a surge in transaction value within the technology sector (up 27%) and sponsor-led buyouts (up 39%). A striking majority of these deals were conducted in VDRs.

A well-organized data room can make life easier for all the parties involved and speed up Due Diligence in a market environment which rewards fast and precise decision-making.

Conversely, errors or negligence in this area can delay or even result in transaction failure.

With this knowledge in mind, we present the best practices for launching and running VDRs in mergers and acquisitions – with a substantive and critical eye.

It’s in a VDR that the seller places all the key information about the company in – contracts, financial statements, corporate documents, employee data, intellectual property. In short, everything that is important for business evaluation is there.

VDR system is a tool that allows controlled access to this data (different levels of access can be granted, e.g. only selected providers can be allowed to access the most sensitive files) and protects its confidentiality thanks to a number of technological security measures.

Unlike emails or shared drives, good VDRs allow you to disable copying or printing documents, add a watermark with a user ID, and all activity is archived. It is basically a digital vault in which the seller shares information in a controlled manner, protecting company secrets while facilitating the transaction. No need for physical visits means time and costs savings, and reaching a wider group of investors faster.

What’s more, modern VDRs also offer analytical functions. Sellers (or their investment advisors) can track who, when, and how often visits the data room, and even which documents are most popular.

This is invaluable knowledge – if one potential investor spends hours studying client contracts, and another logs in from case to case, the seller can draw conclusions about who is seriously interested. We have heard many times from our clients that detailed VDR activity reports even allow the possibility of predicting the “favorites” in the process, and experienced dealmakers can develop an opinion as to which bidder is really involved in the process within six weeks of Due Diligence. Importantly, thanks to AI-based features, experts are able to make a similar assessment even faster.

In other words, VDR is not just a passive digital document storage box, but also a strategic tool in the hands of the seller (and buyer), provided it is used skillfully.

Since dealrooms are at the heart of the Due Diligence process, preparing them should be treated as a priority. A best practice, emphasized by both economists and experienced M&A advisors, is to start assembling the VDR as early as possible.

Harvard Business Review even suggests that companies (e.g. startups) maintain a constantly updated Virtual Data Room even before they officially enter the M&A path. In other words: always have your documents in order and be prepared, because the opportunity for acquisition can arise unexpectedly and the time for Due Diligence can be short.

In practice, most companies launch VDR after signing a letter of intent or receiving initial offers. Even at this stage, time is of the essence. Collecting, sorting and describing hundreds of files is a job that takes weeks. From the experience of practitioners: if you think you will manage to build a data room “after hours”, it will be a stressful and frustrating job.

“A complete and well-organized VDR content is absolutely crucial to the success of the transaction, and its preparation is time-consuming and should start as early as possible.”

Ignoring this may result in the transaction being unsuccessful: a lack of a ready data room, constant delays in providing information, or chaos in documents will slow down and in – in critical cases – it can discourage potential clients from proceeding further. Advisors rightly note that many sellers wait until the formal Due Diligence stage to complete their documents, and only then come across unpleasant surprises, which may scare away buyers.

How to prevent this? First of all, engage the right people and draw up a plan. The company’s top management must understand that a reliable data room is not an “option” but a condition for a successful sale. It is best to appoint a VDR project coordinator (e.g. a financial or project director) and a small team of people with knowledge of individual areas of the company’s operations.

Their task will be to gather a complete set of documents. It is worth using ready-made Due Diligence lists – e.g.a checklist of what should be in a data room. It usually includes dozens of items from every area of ​​the company’s operation: from basic registration documents and founding agreements, through capital structures, commercial contracts, assets and real estate, financial data, taxes, HR, intellectual property, up to contracts with key customers and suppliers. The rule is simple: everything that may be important to a potential buyer should go into the VDR.

Once the data room is filled with documents and open to potential investors, the actual Due Diligence marathon begins. The role of the seller (and their advisors) is now smart access and communication management within the VDR, as well as ensuring information security.

Here are the best practices for running a Virtual Data Room in M&A:

Access management and confidentiality control

• Only share VDR with verified people after they sign the NDA
• Level access: general data for everyone, sensitive data only for the chosen ones
• Manage permissions folder by folder, close access immediately after a bidder is eliminated

Security and legal compliance

• Use a reputable VDR provider that is GDPR, ISO 27 001 compliant
• Anonymize sensitive data (e.g. personal data, individual prices, contractors)
• Use security features: read-only mode, watermarks, IP restrictions, and more

Communication with investors (Q&A module)

• Establish in advance who answers questions and what the process for approving answers looks like
• Respond quickly and objectively: this is part of building trust
• Don’t hide the facts – transparency always works to the seller’s advantage

Update and tidy up

• Update documents regularly and clearly mark their new versions
• Inform investors about key changes (even if VDR does it automatically)
• Keep your folder structure consistent, avoid chaos, duplicates and ambiguity

M&A managers and advisors are usually experienced in running data rooms, but it is worth paying attention to the most common traps and mistakes, which are repeated surprisingly often in industry conversations. These include:

VDR launched too late

As we have already emphasized, delaying the organization of the data room means unnecessary multiplication of problems. Unfortunately, there are still sellers who leave this stage until the very end. The result is frantic document scanning after hours, and uploading unreviewed files at the last minute. The result? Delays in the process, unhappy investors waiting for documents or, worse, important issues that only come to light when it’s too late, which can seriously damage the seller’s credibility.

“One could say figuratively that waiting to have your company X-rayed until the buyer does it for you is like hiding a bad tooth from the dentist. Sooner or later, it will come out, and the pain will be greater.”

Insufficient completeness or quality of data

Omitting an important document in the VDR can result not only in additional questions (at best) but also in loss of trust. If the buyer discovers on their own that there is some agreement or commitment that was not in the data room, they will start to suspect that something was being hidden.

On the other hand, posting incomplete documentation (e.g. contracts without signatures, drafts instead of final versions) indicates chaos. Best practice: before you release your VDR, do an internal test. Have a trusted professional (e.g. assistant or the VDR Project Manager) check that the documentation is consistent, complete, and easy to find.

Savings where they shouldn’t be

The prices of professional VDRs depend on the duration of the process, capacity, customer support, but in the context of transaction costs, these are not prohibitive amounts. It is often a fraction of the value of the deal. Nevertheless, the temptation to save and conduct Due Diligence, e.g. on a shared Google drive or in WeTransfer using links, is often high. This is not a recommended practice. The lack of required security measures, lack of activity logs, lack of technical support and the risk of leakage (or even accidental sharing of the link with third parties) make such practices a serious threat to transactions.

A professional investor will usually request a reputable data room. Using a popular solution signals lack of professionalism.

Underutilization of VDR potential

Finally, it is worth taking a long-term view. After closing a transaction, many companies… forget about the data room. Data collected in the VDR and conclusions from Due Diligence often end up on the shelf, instead of being transformed into, for instance, an integration or improvement plan for the new, merged company. Experts indicate that valuable insights revealed during Due Diligence are often “abandoned” in the VDR and not used during post-acquisition integration.

This is a wasted opportunity. Since we have already put so much effort into vetting the company, let’s learn from it. Good M&A practices assume that after the acquisition, we should share key Due Diligence findings with the integration teams, so that from day one after closing they know what to look for (i.e. which areas need fixing, what risks need to be monitored).

Virtual Data Room is today an indispensable second-line hero in the world of mergers and acquisitions. A paradox appears here: the best data room is the one that… no one talks about. Because the process went smoothly, the documents were not leaked to unauthorized persons, and investors had no reason to complain. However, legends about poorly executed transactions can circulate for a long time.

VDR management standards offered by advisors will almost certainly be at a world-class level, but awareness of good transaction practices must be constantly built. Virtual Data Room has become a symbol of professionalism in transactions, and its use should be accompanied by this knowledge in mind: be prepared before the buyer knocks, maintain order and transparency of data, protect information like it’s the most valuable treasure, and at the same time – play with open cards.