Do I need an NDA before showing my business financials to a buyer?

Using a non-disclosure agreement before you release financials is standard practice in a private business sale, and government business agencies recommend it, but it is a commercial safeguard rather than something the law requires. An NDA is a contract: it obliges the recipient to keep genuinely confidential information secret and to use it only for the stated purpose, and it gives you a legal basis to act if they do not. It does not cover information the recipient already knew, information already public, or information they develop independently, and enforcing it means going to court — which is slow and expensive, and cannot un-disclose what has already been seen. The practical protection is releasing information in stages to qualified buyers, with the NDA as the gate on the first real tier.

By the bizflip team · Published 2 September 2026 · Facts checked 2 September 2026 · Sources listed below

Short answer: yes, use one — but understand what you are getting. An NDA is not a legal precondition for showing a buyer your numbers. It is what sellers and their advisers do as a matter of practice, and Australian government business agencies recommend it. Business Queensland tells sellers to ask the potential buyer to sign a non-disclosure agreement before sharing confidential and sensitive business documents, and to have their solicitor draw one up for all buyers to sign. IP Australia lists potential new owners among the people you should have a signed NDA with before disclosing business methods or processes.

What it is not is a force field. Understanding the gap between what an NDA does on paper and what it can do in practice is the difference between using it well and relying on it. The official guidance quoted here is Australian, because those agencies publish theirs plainly and for free; because an NDA is a contract, almost everything below is about the document rather than about any one country's law, and where a detail genuinely differs by market — the number that identifies a company, the privacy regime covering staff records — this article names the difference instead of picking one.

What an NDA actually is

A confidentiality agreement is a legally binding contract. If you disclose confidential information to another person under one, they are required to keep that information secret and confidential, and not to misuse it. That is the whole mechanism: a promise you can sue on.

In a business sale it typically gates the first real tier of disclosure. The public listing stays anonymised; the information memorandum and headline financials go to a buyer who has signed; named customer contracts, supplier pricing and identified employee records wait until that buyer has made an offer and shown they can fund it. What the NDA is gating is substantial — Australia's business.gov.au directs buyers to examine three to five years of financials, including tax returns, the periodic tax filings the business makes (business activity statements, in Australia), balance sheets, cash flow statements and sales records, alongside your contracts, leases and licences.

What it does for you

It creates an obligation where none otherwise exists. Without an agreement, a person you show your numbers to may face few constraints on using them. With one, they have a contractual duty to keep the information secret and to use it only for the purpose the agreement names — evaluating a possible acquisition, and nothing else.
It deters. Most people who sign one behave, and a competitor who has signed a document naming them and their company thinks twice before circulating your customer list.
It sets out what happens at the end. A well-drafted agreement requires the recipient to return confidential information on demand and to delete electronic copies, while customarily allowing them to keep one archival copy so both sides know what the obligations still attach to.
It gives you a remedy to pursue. Confidentiality agreements often state that damages are not an adequate remedy and that injunctive relief may therefore be appropriate — largely a restatement of the law, and a signal that the practical remedy is a court order stopping further use rather than a cheque.
It documents that the information was confidential when you handed it over, which matters if there is ever an argument about it.

What it does not do

An NDA protects information that is genuinely confidential. It does not turn everything you label confidential into a secret. Obligations of confidentiality normally end in relation to:

information the recipient already knows;
information that enters the public domain other than through a breach of the agreement;
information independently developed by the recipient's staff who had no access to what you disclosed;
information disclosed to them without any obligation of confidence by another person entitled to disclose it.

A court order or subpoena also overrides secrecy, though a well-drafted agreement relaxes the obligation only to the extent of the legal requirement rather than ending it.

Two further limits are practical rather than legal. First, an NDA does not stop disclosure; it gives you a claim after one. If a competitor reads your customer concentration and your margins, that knowledge cannot be returned, and an injunction stops further use rather than undoing what has been learned. Second, enforcing a contract means going to court, with the cost, delay and evidentiary burden that implies — you would need to show what was disclosed, that it was confidential, that it was used or disclosed in breach, and what that cost you. This is why the terms in the agreement about written confirmation of oral disclosures, and about keeping a record of what was shared and when, matter more than they look: they are the proof you would need. If enforcement ever becomes a live question, that is a conversation with a lawyer, not a template.

What to check in the document

Business Queensland's checklist for confidentiality agreements is a good test of a draft in any market, because the questions it asks are about the document rather than about Australian law. Its own caution is worth repeating: the list is not exhaustive and is not a substitute for legal advice, which should always be taken on any confidentiality agreement.

One-way or two-way. In a business sale it is usually one-way, but a buyer sharing their own funding or structure may want mutual obligations.
The parties' full correct legal names. A business name or a division of a company is not a legal entity and cannot be a party. If a party is a company, record the number its register gives it alongside the name — an ACN in Australia, the Companies House company number in the UK, the entity number the state register assigns in the US, where the federal EIN is a tax identifier rather than a registration number. That number is what ties the obligation to the entity instead of to a trading style.
The definition of confidential information. It needs to be precise enough to identify what is covered — if it is too broad it may be meaningless. Cover business and financial information explicitly, not just intellectual property.
A clear obligation to keep the information secret and not disclose it, and a separate obligation to use it only for the stated purpose, with all other uses prohibited.
Permitted disclosure to the recipient's employees and directors, which is the only workable way a corporate recipient can consider the material. The company remains liable for their acts, so they need not be parties themselves. Extend this to the buyer's accountant and lawyer, who will need to see the numbers.
How oral disclosures are treated. Some agreements only cover written disclosures unless an oral one is confirmed in writing within a time limit — workable, but only if you actually send those confirmations.
Duration. A fixed term of, say, five years is common in fast-moving sectors; elsewhere the obligation can run for as long as the information stays out of the public domain.
Return and deletion of material on demand, including electronically stored copies, and the archival copy exception.
A requirement that the recipient notify you of any misuse that comes to their attention.
The purpose clause itself. IP Australia's advice is that a good NDA describes why you are sharing the information without specifying the confidential information — the agreement should not itself give the secret away.

The protection that actually works is staging

The NDA is one control among several, and on its own it is the weakest of them. Qualify the buyer before you disclose: Business Queensland suggests researching their online presence, naming a ballpark price and watching the reaction, and asking directly about their capacity to fund a purchase. Keep the sales prospectus itself free of detailed or sensitive financial records — it is a marketing document, and it should not contain anything that would hurt you if it circulated.

Then release in tiers, through a controlled channel. Australia's privacy regulator, the OAIC, writing about privacy in a business sale, names only providing limited electronic access to information — for instance, by making it available through a data room — among the reasonable steps a vendor can take to keep control of what a prospective purchaser is given. Access granted one week can be withdrawn the next, view-only permissions and per-viewer watermarking make a leak traceable, and the access log records who opened what.

Personal information is a separate obligation

An NDA is a promise between you and the buyer. It does not discharge your obligations to third parties. Whatever data-protection law covers your business covers the due diligence you run under it, and the buyer's signature does not displace that law — so the thing to settle before you upload staff files or a customer database is which regime applies to you and what it allows you to hand over. Australia's guidance shows the shape of the answer: if the Privacy Act covers the business, a vendor must comply with the Australian Privacy Principles during due diligence, and the OAIC's guidance is to consider whether the information a buyer has asked for can be de-identified — and to avoid providing other employees' records unless they are de-identified or the employees have consented. Give the minimum that answers the buyer's question, whichever regime you are under: a buyer needs the total wage bill, the terms and entitlements attaching to the roles, and the accrued leave liability, not which named person earns what.

Getting one

IP Australia, the Australian government's intellectual property office, publishes a free contract generator that builds an NDA in four steps. Its own disclaimer sets the right expectation for any template, wherever you found yours: the agreements it produces are a starting point that will need to be adapted to the circumstances and, where relevant, reviewed by an independent legal adviser. IP Australia's and Business Queensland's advice is the same — get legal advice before you sign one. For a business sale specifically, having your own lawyer prepare a single agreement that every prospective buyer signs is cheaper than reviewing whatever each buyer sends you, and it keeps your definition of confidential information consistent across the process.

Nothing here is legal advice, and whether a particular clause is enforceable in your circumstances is a question for a lawyer in the jurisdiction whose law the agreement names — a clause worth checking before you sign rather than after, if you and the buyer are in different countries. Our guide to preparing a data room covers the staged release the NDA sits on top of.

Sign the NDA, and then act as though you had not. The information you never released is the only information that cannot leak.

Sources

Every load-bearing claim in this guide, and where it comes from:

Business Queensland tips for qualifying buyers and preparing for due diligence: "Ask the potential buyer to sign a non-disclosure agreement (NDA) before you share your confidential and sensitive business documents"; "ask your solicitor to draw up a non-disclosure agreement (NDA) for all buyers to sign"; "Don't share all the information about your business until you've researched and qualified the buyer"; "Inform them of a ballpark figure for your business, and assess their reaction"; "Politely ask about their financial ability to acquire the business"; and a sales prospectus "should not include detailed or sensitive financial records or anything that could expose your business to risk". — Business Queensland (Queensland Government)
Business Queensland on confidentiality agreements: "A confidentiality agreement is a legally binding contract. If you disclose confidential information to another person under a confidentiality agreement, they are required to keep that information secret and confidential, and not misuse it." Its checklist covers one-way versus two-way agreements, recording parties' full correct legal names ("a business name or a division of a company are not legal entities") and ACN, the definition of confidential information ("The definition needs to be precise enough to be able to identify the confidential information. If it is too broad it may be meaningless"), the obligation to keep secret, use limited to a specified purpose, permitted disclosure to employees and directors, treatment of oral disclosures, duration (a fixed five-year period is "not unusual" in fast-moving sectors, otherwise "as long as the confidential information is outside the public domain"), return and deletion of information with an archival copy retained, and notification of misuse. It states that obligations of confidentiality "will normally end in relation to: information that the recipient already knows[,] information that enters the public domain otherwise than by a breach of the agreement[,] information that is independently developed by staff of the recipient with no access to the confidential information[,] information otherwise disclosed to the recipient without any obligation of confidentiality, by another person who is entitled to disclose it"; that a legal obligation to disclose (a court order, a subpoena) should relax rather than end the obligation; and that agreements sometimes state "that damages are not an adequate remedy, and that injunctive relief may therefore be the appropriate remedy", which is "largely a re-statement of the law". Its caution: the list "is not intended to be a substitute for legal advice, which should always be taken in relation to any confidentiality agreement". — Business Queensland (Queensland Government)
IP Australia: "To secure confidentiality, you should get a signed NDA before telling or showing someone else your... Business methods or processes", including when working with "Potential new owners when IP changes hands"; "A good NDA describes why you're sharing the information without specifying the confidential information"; "you should mark any materials you share with a third party as 'confidential'"; "Store and monitor your NDAs so you can monitor breaches"; "Keep an eye on expiry dates for any NDAs with time limits"; a free contract generator "builds a contract in four simple steps"; and "it's important to seek legal advice before you sign one". — IP Australia (Australian Government)
IP Australia's free non-disclosure contract generator carries the disclaimer: "The agreements provided in this tool are a starting point and will need to be adapted to the circumstances and, where relevant, reviewed by an independent legal advisor." — IP Australia (Australian Government)
OAIC guidance on selling a business: reasonable steps to maintain control of information provided to a prospective purchaser include "only providing limited electronic access to the information—for instance, by making the information available through a data room"; "A vendor must comply with the Australian Privacy Principles during due diligence"; a vendor "should consider whether the information can be de-identified"; and unless "they have the consent of the employees, or the information is de-identified, a vendor should avoid providing records of other employees". — Office of the Australian Information Commissioner
The material a buyer is directed to request — business.gov.au tells buyers to review "financial records, business operations, legal documents" and to "examine the past three to five years of financials" including tax returns, BAS, accounts receivable and payable, balance sheets, profit and loss records, cash flow statements and sales records. That list is what an NDA is gating. — business.gov.au (Australian Government)
Every UK company is identified on the Companies House register by a company number - the official register search invites you to "Enter company name, number or officer name". Supports "the Companies House company number in the UK" in the checklist bullet. — Companies House (UK Government)
US business entities are identified by a number their state of registration assigns: the California Secretary of State defines an entity number as "The identification number assigned to a business entity by the California Secretary of State at the time of registration." Supports "the entity number the state register assigns in the US" in the checklist bullet. — California Secretary of State
The IRS describes an Employer Identification Number (EIN) as "a federal tax ID number for businesses, tax-exempt organizations and other entities" - a tax identifier, not a registration number. Supports "where the federal EIN is a tax identifier rather than a registration number" in the checklist bullet. — Internal Revenue Service (US Government)

Ready for your own number? The valuation calculator is free and ungated, and its methodology is public.