Australia guides

What is a data room for selling a business?

A data room is the access-controlled place — almost always online — where a seller puts the documents a buyer needs to verify the business: financials, tax returns, contracts, leases, licences, asset and employee records. The seller decides who can open what and can withdraw access at any point. It has two jobs: let a serious buyer confirm your numbers quickly, and keep confidential information under your control while they do.

By the bizflip team · Published 30 August 2026 · Facts checked 30 August 2026 · Sources listed below

Put simply: one online folder structure, one access list, one indexed place where every document a buyer asks for already lives. Run this way, due diligence leaves an auditable trail instead of a scattered inbox, and access granted one week can be withdrawn the next. This page covers what goes in a data room, why staged release matters, and the privacy and disclosure rules that sit around a sale. Those rules are set locally: the obligations named below are examples of the kind of rule to look for where your business is being sold, not a substitute for checking your own.

What goes in one

A data room holds the evidence behind every claim your listing and information memorandum make. The due diligence checklist government guidance hands buyers — business.gov.au's is a good example of the genre — is a fair proxy for what will be asked of you, because it is what the other side is told to look for:

Very little of this is exotic. Wherever you trade, tax and company law already make you keep most of it for years after the fact — only the number of years moves. In Australia the ATO requires most business records to be kept for five years and says the obligation runs as you start, run, sell, change or close a business, an Australian company must keep financial records for at least seven years, and Australian employers must keep time and wages records for seven years. A UK company must keep its records for six years from the end of the last company financial year they relate to, or longer where a transaction spans more than one accounting period or HMRC opens a compliance check. In the US the IRS puts the general period at three years, and employment tax records at a minimum of four years from the date the tax was due or paid. Work to the longest period that applies to you. Either way, assembling a data room is mostly gathering documents you are already required to hold, which is why the exercise tends to surface gaps rather than create work.

Why a data room rather than email

Beyond access lists, the usual controls are view-only permissions on the most sensitive files, watermarking each viewer's copy with their own name so a leaked document identifies its source, and releasing material in stages rather than all at once.

Privacy obligations, which change with where you are

A data room usually holds personal information — employee records, sometimes customer or client data. Whether a data protection law governs what you do with it, and which one, is the thing that moves most between markets, so settle it before you upload anything. In Australia, most small businesses — those with an annual turnover of A$3 million or less — are not covered by the Privacy Act, and the OAIC states plainly that where the Act does not cover the business being sold the due diligence process is not affected, with one exception below; where the Act does apply, a vendor must comply with the Australian Privacy Principles during due diligence. The UK has no equivalent small-business exemption: you must follow the data protection rules if your business stores or uses personal information, and keep that information secure, accurate and up to date. In the US it is a patchwork rather than one national rule — the Federal Trade Commission notes that many states and the federal bank regulatory agencies have their own laws or guidelines on data breaches, and tells businesses to consult their attorney. Whichever regime covers you, the first question is the same: consider carefully whether what a buyer has asked for includes personal information at all.

The Australian exception is the one that bites in a business sale. Selling assets that include the personal information in your customer database is itself 'trading in personal information', and the Privacy Act covers any organisation trading in personal information whatever its turnover. So if the customer list is part of what you are selling, do not lean on the small-business exemption. The transferable lesson is to test the sale separately from the ordinary course: a threshold that leaves you outside a privacy regime day to day may be read differently when the thing being sold is the data.

Where personal information is in scope, the discipline is the same wherever you are, and worth applying even where no regime reaches you: de-identify it if the buyer's question can be answered without names, and avoid providing other employees' records unless they are de-identified or the employees have consented. Most due diligence questions can be answered that way — a buyer needs the wage bill, the pay rates and entitlements attaching to the roles, the leave or paid-leave liability and the length of service behind it, not who earns what. Unauthorised disclosure then carries its own reporting duty, and that duty is local: in Australia, a disclosure of personal information likely to result in serious harm is a notifiable data breach, reportable to the OAIC and to the people affected, while in the US the obligation comes from state and sector breach laws instead. Find out what yours requires before a folder reaches the wrong buyer, not after.

Release in stages, not all at once

A data room is tiered, and the tiers matter more than the software. An anonymised summary is public. The standard advice everywhere — Business Queensland's version is to ask the potential buyer to sign a non-disclosure agreement before you share confidential and sensitive business documents — puts the NDA on the first real tier, which is typically the information memorandum and headline financials. Detailed material such as named customer contracts, supplier pricing and identified employee records waits until a buyer has made an offer and shown they can fund it.

Staging is what protects you from the enquiry that is really a competitor. They can see enough to price an offer without ever seeing the customer list.

Two things sellers commonly miss

Compulsory disclosure sits alongside the data room, not inside it. Some places require a prescribed vendor's statement to be handed to the buyer before contract, on pain of the contract itself being at risk — and how local that requirement gets is worth seeing. In Victoria, Australia, a small business sold at a price up to A$450,000 requires a statement by a vendor of a small business, the section 52 statement, in the form prescribed under the Estate Agents (General, Accounts and Audit) Regulations 2018 and available from Consumer Affairs Victoria; it doubles as a due diligence guide for the buyer, sets out the business's financial performance for the last two years plus the current financial year to the most recent quarter, and if it is not provided to the purchaser the contract can be voided. One state away, in South Australia, the trigger and the form are different again: anyone selling a business for less than A$300,000 excluding GST must give the purchaser a Form 2 vendor's statement under the Land and Business (Sale and Conveyancing) Act 1994. Two neighbouring states, two thresholds, two forms — which is the point. Ask a lawyer where the business is actually being sold what prescribed disclosure applies before you go to market, and never carry the answer over from somewhere else.

Employee records get handed over after settlement, not during due diligence. Where staff transfer with the business, expect an obligation to pass their records to the new employer on a timetable set by local employment law: in Australia, where the sale is a transfer of business, the old employer must give the new employer the records of any transferring employee, and the new employer has to ask for them for anyone who becomes their employee within three months of the sale. Check the equivalent rule wherever your people are employed. Either way, a complete employment folder makes it a task rather than a scramble.

Getting one ready

Start this before you go to market. Gaps take weeks to close, and the work overlaps almost entirely with getting a defensible price together — the same normalised earnings and clean financials feed a market appraisal. Our other selling guides cover the surrounding steps, and businesses currently listed show the level of disclosure buyers now expect to see.

A tidy data room does not make a business worth more on its own. What it does is remove reasons to discount: buyers price uncertainty, and unanswered questions are uncertainty.

Sources

Every load-bearing claim in this guide, and where it comes from:

Ready for your own number? The valuation calculator is free and ungated, and its methodology is public.