NDA for M&A UK: Protecting Both Sides of a Business Acquisition

An acquisition touches the most sensitive information in any business: financials, customer contracts, key-person dependencies, IP, and operational weaknesses. The NDA is the gate — the document that controls who sees what, on what terms, and what they can do with it if the deal does not close. This guide covers the full M&A process from both sides: acquirer and target. For the seller's perspective in a sale process specifically, see the NDA for selling a business guide.

The NDA's role before the letter of intent

In a UK M&A process, the NDA is signed before the letter of intent (LOI) or heads of terms — often before the management presentation. The sequence matters. By the time an acquirer sits in a room with the target's management team, they are receiving information that could give a competitor an advantage. The NDA has to be in place first.

The pre-LOI NDA does three things: it creates a contractual obligation of confidence, it sets the scope of what is protected (usually broadly defined to cover everything shared in the process), and it gives the disclosing party a clear route to an injunction if confidence is breached.

The LOI or heads of terms that follows will typically contain its own confidentiality provisions, but these are usually lighter. The NDA remains the primary confidentiality instrument for everything disclosed before and during due diligence.

Mutual vs one-way: which applies at each stage

The right NDA shape depends on which way information is flowing at each point in the process. A deal that starts one-way typically becomes mutual:

Most M&A practitioners sign a mutual NDA at the outset to avoid re-papering mid-process. The NDASafe Mutual NDA is the standard choice. Where only the target is disclosing at the very first stage, the One-Way NDA (disclosing party) can be used before upgrading.

What an M&A NDA must cover

A standard commercial NDA protects confidential information. An M&A NDA needs to go further. The provisions that distinguish an acquisition NDA from a routine confidentiality agreement are:

• Existence of the process. The fact that the business is for sale or acquisition talks are underway is itself confidential. Employees learn, key clients ask questions, and suppliers adjust terms — all from a leak before any deal is signed. State expressly that the existence, terms and status of discussions are covered.
• Non-solicitation. The acquirer has seen the target's organisational chart, met the key management team, and reviewed customer contracts. Without a non-solicitation clause, nothing stops them approaching those people directly if the deal collapses. Non-solicitation typically covers employees, customers and key suppliers for 12–24 months.
• Non-circumvention. The acquirer should not be able to use knowledge gained in due diligence to go around the seller and deal directly with a supplier, joint-venture partner or customer they only learned about through the process. Non-circumvention closes that route.
• Standstill (optional but common). A standstill clause prevents the acquirer from making unsolicited approaches to shareholders or taking any steps to acquire a stake in the target outside the agreed process for a fixed period. It is most relevant for listed companies but appears in private M&A contexts where the seller wants to run an orderly process.
• Permitted recipients. Data-room access should be limited to named individuals or defined categories — deal team, legal counsel, financial advisers — each bound by the same terms. An open-ended grant to 'the acquirer and its affiliates' is too wide.
• Return or destruction. If the deal does not proceed, the acquirer should return or destroy all confidential materials and certify that they have done so. This limits residual risk from information remaining in the acquirer's systems.

Due diligence and the data room

Due diligence is where the NDA earns its value. The target grants access to a data room — a structured repository of financial statements, contracts, employee information, IP registrations, litigation history, regulatory filings, and operational detail. The NDA is what makes that level of disclosure legally safe.

In practice, the NDA gates data-room access: the acquirer's team cannot log in until the NDA is signed. Many sellers use a tiered data room — a lighter Level 1 room available on NDA signature, with a more sensitive Level 2 room available only after an indicative offer is accepted and exclusivity begins. The NDA governs both.

The NDA should also address what happens to data-room materials if the deal fails. A data-room conducted under a well-drafted NDA means the acquirer cannot use what they learned to compete with the target, poach staff, or approach customers — because the NDA's non-solicitation and non-circumvention obligations continue beyond the end of the process.

Duration and trade-secret survival

Two to three years is the market standard for M&A deal information. That covers the window during which financials, deal strategy and customer data remain commercially sensitive after a collapsed process.

Genuine trade secrets — proprietary processes, source code, formulas, unique technical know-how — should survive indefinitely. A single term that imposes a two-year obligation on everything disclosed may fail to protect the most valuable assets in the target's data room. The better approach is to carve out defined trade-secret categories and state that the obligation over those survives without limit.

See the how long should an NDA last guide for the enforceability principles underlying these choices.

When to use NDASafe and when to instruct a solicitor

The NDASafe Mutual NDA is appropriate for:

• SME acquisitions (deals up to roughly £5m–£10m in enterprise value) where the parties know each other and the deal structure is straightforward.
• Early-stage conversations — first approaches, management presentations, and initial due diligence — before a full legal team is engaged.
• Asset deals and micro-cap transactions where the NDA is the main transaction document and the parties need to move quickly.

A solicitor adds most value where:

• The deal value is substantial (£10m+) or involves material IP, regulatory approvals, or a complex capital structure.
• One or both parties are listed companies, requiring compliance with the Takeover Code and the City Code on Takeovers and Mergers.
• The transaction is cross-border — even an English-law NDA needs careful consideration if the counterparty is overseas and enforcement may be needed in a foreign jurisdiction.
• The seller has strong leverage and wants bespoke standstill, exclusivity, or break-fee provisions that go beyond a standard template.

For everything in between, the NDASafe Mutual NDA provides a legally reviewed UK-law starting point that captures the provisions most deal processes actually need — and can be completed and signed the same day.