What is a data room for selling a business?
A data room is the access-controlled place — almost always online — where a seller puts the documents a buyer needs to verify the business: financials, tax returns, contracts, leases, licences, asset and employee records. The seller decides who can open what and can withdraw access at any point. It has two jobs: let a serious buyer confirm your numbers quickly, and keep confidential information under your control while they do.
By the bizflip team · Published 30 August 2026 · Facts checked 30 August 2026 · Sources listed below
Put simply: one online folder structure, one access list, one indexed place where every document a buyer asks for already lives. Run this way, due diligence leaves an auditable trail instead of a scattered inbox, and access granted one week can be withdrawn the next. This page covers what goes in a data room, why staged release matters, and the privacy and disclosure rules that sit around an Australian sale.
What goes in one
A data room holds the evidence behind every claim your listing and information memorandum make. The guidance business.gov.au gives buyers is a fair proxy for what will be asked of you, because it is what the other side is told to look for:
- Financial records — the past three to five years of financials: tax returns, business activity statements, records of accounts receivable and payable, balance sheets, profit and loss records, cash flow statements and sales records.
- Contracts and leases — whether the landlord will agree to transfer the lease or a new lease must be negotiated, and any outstanding agreements between the seller and suppliers.
- Licences and permits — everything the business needs to operate, and whether each is up to date.
- Assets — what the business owns, any intellectual property, and the state of plant, equipment and fixtures.
- Inventory — whether stock on hand is included in the purchase, and what state it is in.
- Liabilities — outstanding debts, refunds and warranties still on foot, and whether debts owing on assets are registered on the Personal Property Securities Register.
Very little of this is exotic. The ATO requires most business records to be kept for five years, and says the obligation runs as you start, run, sell, change or close a business. A company must keep financial records for at least seven years, and employers must keep time and wages records for seven years. Assembling a data room is mostly gathering documents you are already required to hold, which is why the exercise tends to surface gaps rather than create work.
Why a data room rather than email
- Control. Access is granted per person and can be withdrawn. The OAIC, writing about privacy when selling a business, names limited electronic access through a data room as one of the reasonable steps a vendor can take to keep control of information given to a prospective purchaser.
- Sequence. Due diligence often runs to a deadline set in the heads of agreement. A buyer's accountant and solicitor working from a structured index find their own answers; the same documents scattered through an inbox generate follow-up questions, and every follow-up costs days.
- A record of what was disclosed. A proper data room logs which document was opened, by whom, and when. If a dispute later turns on what the buyer was shown before signing, that log is a contemporaneous record of it.
Beyond access lists, the usual controls are view-only permissions on the most sensitive files, watermarking each viewer's copy with their own name so a leaked document identifies its source, and releasing material in stages rather than all at once.
Privacy obligations, if the Privacy Act covers you
A data room usually holds personal information — employee records, sometimes customer or client data. Whether the Privacy Act governs what you do with it depends on the business: most small businesses, meaning those with an annual turnover of $3 million or less, are not covered, and the OAIC states plainly that where the Act does not cover the business being sold, the due diligence process is not affected — with one exception, below. If yours is covered, the guidance is equally direct: a vendor must comply with the Australian Privacy Principles during due diligence, and should consider carefully whether what a buyer has asked for includes personal information at all.
The exception is the one that bites in a business sale. Selling assets that include the personal information in your customer database is itself 'trading in personal information', and the Privacy Act covers any organisation trading in personal information, whatever its turnover. If the customer list is part of what you are selling, assume you are covered.
Where personal information is in scope, the guidance is to de-identify it if the buyer's question can be answered without names, and to avoid providing other employees' records unless they are de-identified or the employees have consented. Most due diligence questions can be answered that way: a buyer needs the wage bill, the award coverage, the leave liability and the length of service behind it — not who earns what. For a business the Act covers, an unauthorised disclosure of personal information likely to result in serious harm is a notifiable data breach, reportable to the OAIC and to the people affected.
Release in stages, not all at once
A data room is tiered, and the tiers matter more than the software. An anonymised summary is public. Business Queensland's advice is to have a prospective buyer sign a non-disclosure agreement before you share confidential documents — so the NDA gates the first real tier, which is typically the information memorandum and headline financials. Detailed material such as named customer contracts, supplier pricing and identified employee records waits until a buyer has made an offer and shown they can fund it.
Staging is what protects you from the enquiry that is really a competitor. They can see enough to price an offer without ever seeing the customer list.
Two things sellers commonly miss
Compulsory disclosure sits alongside the data room, not inside it. In Victoria, a small business sold at a price up to $450,000 requires a statement by a vendor of a small business — the section 52 statement — in the form prescribed under the Estate Agents (General, Accounts and Audit) Regulations 2018 and available from Consumer Affairs Victoria. It doubles as a due diligence guide for the buyer and sets out the business's financial performance for the last two years plus the current financial year to the most recent quarter. If it is not provided to the purchaser, the contract can be voided. Victoria is not alone: in South Australia, anyone selling a business for less than $300,000 excluding GST must give the purchaser a Form 2 vendor's statement under the Land and Business (Sale and Conveyancing) Act 1994. The rules differ from state to state, so confirm what applies in yours with a lawyer before going to market.
Employee records get handed over after settlement. Where the sale is a transfer of business, the old employer must give the new employer the records of any transferring employee, and the new employer has to ask for them for anyone who becomes their employee within three months of the sale. A complete employment folder makes that a task rather than a scramble.
Getting one ready
- Pull the records, then read them as a buyer would. Business Queensland suggests reviewing them with your accountant and solicitor to check they align with the marketing pitch — a discrepancy you find costs less than one the buyer finds.
- Fix gaps early: an expired licence, an unregistered trade mark, a lease with no consent-to-assign clause.
- Redact and de-identify before upload, not on request.
- Structure folders around the buyer's checklist rather than your own filing habits.
- Decide the tiers before the first buyer arrives, so access decisions are not made under time pressure.
Start this before you go to market. Gaps take weeks to close, and the work overlaps almost entirely with getting a defensible price together — the same normalised earnings and clean financials feed a market appraisal. Our other selling guides cover the surrounding steps, and businesses currently listed show the level of disclosure buyers now expect to see.
Sources
Every load-bearing claim in this guide, and where it comes from:
- business.gov.au tells buyers to review "financial records, business operations, legal documents" and to "examine the past three to five years of financials including: tax returns, business activity statements (BAS), records of accounts receivable and payable, balance sheets, profit and loss records, cash flow statements, sales records". Its due diligence checklist asks "Will the landlord agree to the transfer of the lease into your name? Will you have to negotiate a new lease?", "Are there any outstanding agreements between the seller and suppliers?", whether licences and permits are "up-to-date", what assets and intellectual property the business has, the "Status of plant, equipment and fixtures", whether "the inventory on-hand [is] being included in the purchase", and whether there are "debts owing on assets that are registered on the Personal Property Securities Register". — business.gov.au
- Business Queensland advises: "Ask the potential buyer to sign a non-disclosure agreement (NDA) before you share your confidential and sensitive business documents"; "Along with your solicitor and accountant, review the records you'll be providing to ensure they align with the marketing pitch"; lists financial records, business operation records and legal documents among the documents to prepare for the buyer; and notes "A time period for completing due diligence is often specified in a letter of intent". — Business Queensland
- OAIC guidance on selling a business: "The vendor and any prospective purchasers must take care to protect individuals' privacy rights if the Privacy Act covers the business being sold"; "If the business is a small business that the Privacy Act doesn't cover, then the due diligence process when selling is not affected, unless trading in personal information is involved"; "A vendor must comply with the Australian Privacy Principles during due diligence"; "A business which sells assets, including personal information held in their customer database, is 'trading in personal information'"; "The Privacy Act covers any organisation trading in personal information". Reasonable steps to maintain control of information provided to a prospective purchaser include "only providing limited electronic access to the information—for instance, by making the information available through a data room"; a vendor "should consider whether the information can be de-identified"; and unless "they have the consent of the employees, or the information is de-identified, a vendor should avoid providing records of other employees". — Office of the Australian Information Commissioner
- "Most small businesses are not covered by the Privacy Act 1988"; "A small business is one with an annual turnover of $3 million or less. Annual turnover for the purposes of the Privacy Act includes all income from all sources." Regardless of turnover, the Act covers a business trading in personal information, a health service provider, and a business related to one the Privacy Act covers. — Office of the Australian Information Commissioner
- "A data breach happens when personal information is accessed or disclosed without authorisation or is lost"; "You must notify affected individuals and us when a data breach involving personal information is likely to result in serious harm". — Office of the Australian Information Commissioner
- "You need to keep most records for 5 years"; "You are legally required to keep records of all transactions relating to your tax, superannuation and registration affairs as you start, run, sell, change or close your business". — Australian Taxation Office
- "Companies must keep financial records for at least 7 years"; "Financial records can be electronic. However, you must be able to create hard copies within a reasonable timeframe if you are asked for them". — ASIC
- "Employers have to keep time and wages records for 7 years"; "Where there has been a transfer of business, the old employer has to give the new employer records of any transferring employee. The new employer also has to ask for employment records from the old employer for any transferring employee who becomes an employee within three months of the sale". — Fair Work Ombudsman
- The section 52 statement "is required for the sale of a small business at a price up to $450,000", is completed "using the form prescribed under the Estate Agents (General, Accounts and Audit) Regulations 2018", "provides a due diligence guide for a buyer and sets out the financial performance of the business over the last two years" and, from 20 May 2018, "the financial performance for the current financial year up to the most recent quarter"; "If the statement is not provided to the purchaser, the contract can be voided". — Consumer Affairs Victoria
- "Under the Land and Business (Sale and Conveyancing) Act 1994 (SA) anyone selling a business for less than $300 000 (exclusive of GST) must give the purchaser a Form 2"; "A Form 2 states the gross income, purchases and operating expenses from which the net profit of the business for the last twelve months can be calculated". — Legal Services Commission of South Australia
Ready for your own number? The valuation calculator is free and ungated, and its methodology is public.