Do I need an NDA before showing my business financials to a buyer?

Using a non-disclosure agreement before you release financials is standard practice in an Australian business sale, and government business agencies recommend it, but it is a commercial safeguard rather than something the law requires. An NDA is a contract: it obliges the recipient to keep genuinely confidential information secret and to use it only for the stated purpose, and it gives you a legal basis to act if they do not. It does not cover information the recipient already knew, information already public, or information they develop independently, and enforcing it means going to court — which is slow and expensive, and cannot un-disclose what has already been seen. The practical protection is releasing information in stages to qualified buyers, with the NDA as the gate on the first real tier.

By the bizflip team · Published 2 September 2026 · Facts checked 2 September 2026 · Sources listed below

Short answer: yes, use one — but understand what you are getting. An NDA is not a legal precondition for showing a buyer your numbers. It is what sellers and their advisers do as a matter of practice, and Australian government business agencies recommend it. Business Queensland tells sellers to ask the potential buyer to sign a non-disclosure agreement before sharing confidential and sensitive business documents, and to have their solicitor draw one up for all buyers to sign. IP Australia lists potential new owners among the people you should have a signed NDA with before disclosing business methods or processes.

What it is not is a force field. Understanding the gap between what an NDA does on paper and what it can do in practice is the difference between using it well and relying on it.

What an NDA actually is

A confidentiality agreement is a legally binding contract. If you disclose confidential information to another person under one, they are required to keep that information secret and confidential, and not to misuse it. That is the whole mechanism: a promise you can sue on.

In a business sale it typically gates the first real tier of disclosure. The public listing stays anonymised; the information memorandum and headline financials go to a buyer who has signed; named customer contracts, supplier pricing and identified employee records wait until that buyer has made an offer and shown they can fund it. What the NDA is gating is substantial — business.gov.au directs buyers to examine three to five years of financials, including tax returns, business activity statements, balance sheets, cash flow statements and sales records, alongside your contracts, leases and licences.

What it does for you

It creates an obligation where none otherwise exists. Without an agreement, a person you show your numbers to may face few constraints on using them. With one, they have a contractual duty to keep the information secret and to use it only for the purpose the agreement names — evaluating a possible acquisition, and nothing else.
It deters. Most people who sign one behave, and a competitor who has signed a document naming them and their company thinks twice before circulating your customer list.
It sets out what happens at the end. A well-drafted agreement requires the recipient to return confidential information on demand and to delete electronic copies, while customarily allowing them to keep one archival copy so both sides know what the obligations still attach to.
It gives you a remedy to pursue. Confidentiality agreements often state that damages are not an adequate remedy and that injunctive relief may therefore be appropriate — largely a restatement of the law, and a signal that the practical remedy is a court order stopping further use rather than a cheque.
It documents that the information was confidential when you handed it over, which matters if there is ever an argument about it.

What it does not do

An NDA protects information that is genuinely confidential. It does not turn everything you label confidential into a secret. Obligations of confidentiality normally end in relation to:

information the recipient already knows;
information that enters the public domain other than through a breach of the agreement;
information independently developed by the recipient's staff who had no access to what you disclosed;
information disclosed to them without any obligation of confidence by another person entitled to disclose it.

A court order or subpoena also overrides secrecy, though a well-drafted agreement relaxes the obligation only to the extent of the legal requirement rather than ending it.

Two further limits are practical rather than legal. First, an NDA does not stop disclosure; it gives you a claim after one. If a competitor reads your customer concentration and your margins, that knowledge cannot be returned, and an injunction stops further use rather than undoing what has been learned. Second, enforcing a contract means going to court, with the cost, delay and evidentiary burden that implies — you would need to show what was disclosed, that it was confidential, that it was used or disclosed in breach, and what that cost you. This is why the terms in the agreement about written confirmation of oral disclosures, and about keeping a record of what was shared and when, matter more than they look: they are the proof you would need. If enforcement ever becomes a live question, that is a conversation with a solicitor, not a template.

What to check in the document

Business Queensland's checklist for confidentiality agreements is a good test of a draft. Its own caution is worth repeating: the list is not exhaustive and is not a substitute for legal advice, which should always be taken on any confidentiality agreement.

One-way or two-way. In a business sale it is usually one-way, but a buyer sharing their own funding or structure may want mutual obligations.
The parties' full correct legal names. A business name or a division of a company is not a legal entity and cannot be a party. If a party is a company, its ACN should be recorded.
The definition of confidential information. It needs to be precise enough to identify what is covered — if it is too broad it may be meaningless. Cover business and financial information explicitly, not just intellectual property.
A clear obligation to keep the information secret and not disclose it, and a separate obligation to use it only for the stated purpose, with all other uses prohibited.
Permitted disclosure to the recipient's employees and directors, which is the only workable way a corporate recipient can consider the material. The company remains liable for their acts, so they need not be parties themselves. Extend this to the buyer's accountant and solicitor, who will need to see the numbers.
How oral disclosures are treated. Some agreements only cover written disclosures unless an oral one is confirmed in writing within a time limit — workable, but only if you actually send those confirmations.
Duration. A fixed term of, say, five years is common in fast-moving sectors; elsewhere the obligation can run for as long as the information stays out of the public domain.
Return and deletion of material on demand, including electronically stored copies, and the archival copy exception.
A requirement that the recipient notify you of any misuse that comes to their attention.
The purpose clause itself. IP Australia's advice is that a good NDA describes why you are sharing the information without specifying the confidential information — the agreement should not itself give the secret away.

The protection that actually works is staging

The NDA is one control among several, and on its own it is the weakest of them. Qualify the buyer before you disclose: Business Queensland suggests researching their online presence, naming a ballpark price and watching the reaction, and asking directly about their capacity to fund a purchase. Keep the sales prospectus itself free of detailed or sensitive financial records — it is a marketing document, and it should not contain anything that would hurt you if it circulated.

Then release in tiers, through a controlled channel. The OAIC, writing about privacy in a business sale, names only providing limited electronic access to information — for instance, by making it available through a data room — among the reasonable steps a vendor can take to keep control of what a prospective purchaser is given. Access granted one week can be withdrawn the next, view-only permissions and per-viewer watermarking make a leak traceable, and the access log records who opened what.

Personal information is a separate obligation

An NDA is a promise between you and the buyer. It does not discharge your obligations to third parties. If the Privacy Act covers your business, you must comply with the Australian Privacy Principles during due diligence, and the OAIC's guidance is to consider whether the information a buyer has asked for can be de-identified — and to avoid providing other employees' records unless they are de-identified or the employees have consented. Most due diligence questions can be answered that way: a buyer needs the wage bill, the award coverage and the leave liability, not who earns what.

Getting one

IP Australia publishes a free contract generator that builds an NDA in four steps. Its own disclaimer sets the right expectation: the agreements it produces are a starting point that will need to be adapted to the circumstances and, where relevant, reviewed by an independent legal adviser. IP Australia's and Business Queensland's advice is the same — get legal advice before you sign one. For a business sale specifically, having your solicitor prepare a single agreement that every prospective buyer signs is cheaper than reviewing whatever each buyer sends you, and it keeps your definition of confidential information consistent across the process.

Nothing here is legal advice, and whether a particular clause is enforceable in your circumstances is a question for a solicitor. Our guide to preparing a data room covers the staged release the NDA sits on top of.

Sign the NDA, and then act as though you had not. The information you never released is the only information that cannot leak.

Sources

Every load-bearing claim in this guide, and where it comes from:

Business Queensland tips for qualifying buyers and preparing for due diligence: "Ask the potential buyer to sign a non-disclosure agreement (NDA) before you share your confidential and sensitive business documents"; "ask your solicitor to draw up a non-disclosure agreement (NDA) for all buyers to sign"; "Don't share all the information about your business until you've researched and qualified the buyer"; "Inform them of a ballpark figure for your business, and assess their reaction"; "Politely ask about their financial ability to acquire the business"; and a sales prospectus "should not include detailed or sensitive financial records or anything that could expose your business to risk". — Business Queensland (Queensland Government)
Business Queensland on confidentiality agreements: "A confidentiality agreement is a legally binding contract. If you disclose confidential information to another person under a confidentiality agreement, they are required to keep that information secret and confidential, and not misuse it." Its checklist covers one-way versus two-way agreements, recording parties' full correct legal names ("a business name or a division of a company are not legal entities") and ACN, the definition of confidential information ("The definition needs to be precise enough to be able to identify the confidential information. If it is too broad it may be meaningless"), the obligation to keep secret, use limited to a specified purpose, permitted disclosure to employees and directors, treatment of oral disclosures, duration (a fixed five-year period is "not unusual" in fast-moving sectors, otherwise "as long as the confidential information is outside the public domain"), return and deletion of information with an archival copy retained, and notification of misuse. It states that obligations of confidentiality "will normally end in relation to: information that the recipient already knows[,] information that enters the public domain otherwise than by a breach of the agreement[,] information that is independently developed by staff of the recipient with no access to the confidential information[,] information otherwise disclosed to the recipient without any obligation of confidentiality, by another person who is entitled to disclose it"; that a legal obligation to disclose (a court order, a subpoena) should relax rather than end the obligation; and that agreements sometimes state "that damages are not an adequate remedy, and that injunctive relief may therefore be the appropriate remedy", which is "largely a re-statement of the law". Its caution: the list "is not intended to be a substitute for legal advice, which should always be taken in relation to any confidentiality agreement". — Business Queensland (Queensland Government)
IP Australia: "To secure confidentiality, you should get a signed NDA before telling or showing someone else your... Business methods or processes", including when working with "Potential new owners when IP changes hands"; "A good NDA describes why you're sharing the information without specifying the confidential information"; "you should mark any materials you share with a third party as 'confidential'"; "Store and monitor your NDAs so you can monitor breaches"; "Keep an eye on expiry dates for any NDAs with time limits"; a free contract generator "builds a contract in four simple steps"; and "it's important to seek legal advice before you sign one". — IP Australia (Australian Government)
IP Australia's free non-disclosure contract generator carries the disclaimer: "The agreements provided in this tool are a starting point and will need to be adapted to the circumstances and, where relevant, reviewed by an independent legal advisor." — IP Australia (Australian Government)
OAIC guidance on selling a business: reasonable steps to maintain control of information provided to a prospective purchaser include "only providing limited electronic access to the information—for instance, by making the information available through a data room"; "A vendor must comply with the Australian Privacy Principles during due diligence"; a vendor "should consider whether the information can be de-identified"; and unless "they have the consent of the employees, or the information is de-identified, a vendor should avoid providing records of other employees". — Office of the Australian Information Commissioner
The material a buyer is directed to request — business.gov.au tells buyers to review "financial records, business operations, legal documents" and to "examine the past three to five years of financials" including tax returns, BAS, accounts receivable and payable, balance sheets, profit and loss records, cash flow statements and sales records. That list is what an NDA is gating. — business.gov.au (Australian Government)

Ready for your own number? The valuation calculator is free and ungated, and its methodology is public.