The Due Diligence Risk Nobody Talks About: Email

Every year, organisations spend time and money getting transactions right. They engage advisors, negotiate terms, conduct due diligence, and tighten legal protections. It's serious work, and it matters.

But there's one thing sitting at the centre of almost every deal process: every document request, data exchange, and third-party review.

The virtual data room.

Deal teams use them constantly. They're how financials get shared, how legal documents get reviewed, and how sensitive information gets put in front of counterparties who, in many cases, are still deciding whether to do the deal at all. And in most organisations, VDRs are treated as a file-sharing convenience rather than a transaction risk.

Email feels casual. That's the problem.

Think about how a typical M&A process or capital raise actually runs. Someone sets up a room. Documents get uploaded in a rush to meet the process timeline. Access gets granted broadly because it's easier than being precise. Advisors bring in their own teams and share credentials. The process runs for weeks or months, and then, whether the deal closes or falls apart, the room gets forgotten about.

But the information doesn't disappear. The documents are still there. The download history is still there. And in many cases, the access permissions are too.

Deal teams focused on getting to close often treat the data room as infrastructure rather than risk. That's a mistake. How information is shared, tracked, and controlled during a transaction has direct consequences for the deal itself, and for what happens after it.

Nobody knows what was shared, or with whom

Most organisations move fast during a live process. Rigorous information controls are often the first thing to slip.

In practice, VDR contents end up all over the place. Documents get downloaded and saved to personal devices. Access gets granted to advisors who quietly extend it to colleagues who were never part of the original process. Permissions set on day one are never reviewed as the process evolves. And when the deal concludes, nobody does a proper audit of what left the room.

This becomes a serious problem when something goes wrong. If a deal leaks to the press before announcement, if a competitor appears to know more than they should, or if a dispute arises about what was disclosed and when, the data room is the first place anyone will look. When a deal team can't produce a clear record of who accessed what and when, it raises difficult questions that are hard to answer under pressure.

Counterparties are not always on your side, even in friendly deals

Here's something worth sitting with: the people you invite into a data room have their own interests, and those interests don't always align with yours.

Potential acquirers, investors, and their advisors get access to your most sensitive documents during due diligence — strategies, financials, customer contracts, personnel structures. That information has real value, sometimes more value if the deal doesn't proceed.

Most deal teams focus on whether the NDA is signed. Fewer focus on whether the VDR itself is configured to limit exposure in practice. Broad folder access, no download restrictions, no watermarking, no alerts when someone pulls a large volume of documents in a short window. The legal protection is in place but the operational controls are not.

Nor is the risk limited to external parties. Internal stakeholders are often given access that outlasts their involvement in the process. Someone who was part of the early-stage work and still has live credentials six months later is a risk that nobody planned for and nobody is managing.

Information leakage kills deals

Confidentiality failures during a transaction are not just embarrassing. They are deal-killers.

A leak before announcement can trigger regulatory scrutiny, move markets, and destroy the trust between parties that a successful close depends on. A poorly controlled data room that allows a counterparty's team to access documents beyond the agreed scope can create disclosure complications that take months to unwind legally.

It's rarely deliberate. A document gets uploaded to the wrong folder. A permission level is set too broadly under time pressure. An advisor's team member downloads a sensitive file and circulates it internally to people who were never in scope. Nobody intended harm, but the damage is real and often irreversible.

Once information has been downloaded, forwarded, or cached, it cannot be recalled. Deal teams that treat this as someone else's problem find out too late that the responsibility was theirs all along.

So what should deal teams actually do?

This isn't an argument for slowing down transactions or adding bureaucracy to an already complex process. It's an argument for treating VDR management as a core part of transaction execution, because that's what it is.

A few practical steps make a real difference.

Choose the platform for the deal, not by habit. Most organisations default to whichever VDR they used last time. Platform capabilities vary significantly — audit trail quality, permission granularity, watermarking, bulk download alerts, and access expiry controls all differ in ways that matter during a live process. The choice should be deliberate.

Set the access architecture before the room opens. Who sees what, under what conditions, and for how long should be decided before the first document goes in. Permissions granted in a hurry at the start of a process are almost never reviewed mid-stream.

Actively monitor access during the process. VDRs generate detailed logs of who is looking at what and when. Deal teams that review this data in real time can spot unusual activity before it becomes a problem.

Run a proper close-down when the process ends. Whether the deal completes or not, there should be a defined procedure for revoking all access, confirming what was downloaded, and archiving the room in a controlled way. This is not optional housekeeping. It is a legal and commercial responsibility.

Disputes look different when the records are clean

When transactions go wrong — and some always do — the data room becomes a central piece of evidence. What was disclosed, when it was disclosed, and who had access to it directly affects how warranty claims, misrepresentation disputes, and regulatory inquiries get resolved.

Deal teams that can produce a clean, complete audit trail are in a fundamentally stronger position than those whose only answer is "we shared everything in the room." The difference between a well-governed process and a poorly governed one often comes down to whether anyone was paying attention during it, not just at the end.

The bottom line

Successful transaction management depends on controlling information as carefully as you negotiate terms. Virtual data rooms, as most deal teams use them today, are not being managed to that standard. They are too loosely configured, too broadly accessed, and too rarely reviewed until something goes wrong.

The data room is not just a place to store documents. It is where the information risk of a transaction either gets managed or gets ignored.