Virtual Data Room VDR

A virtual data room is used to show a company's confidential documents to outsiders under control. The usual occasion is due diligence before a sale or an investment. The seller's advisers load contracts, accounts, corporate records and employment documents into folders with a numbered index. Bidders and their advisers are then let in to read.

The documents stay in one place and the readers come to them. Most rooms add a question-and-answer function, so that a bidder's questions and the seller's replies are kept beside the documents they concern.

The room also becomes evidence. A seller may later need to show that a document was available to the buyer before signing. For that reason the contents are commonly frozen at signing and an archive copy is kept. How far disclosure through a data room limits a seller's liability depends on the agreement and its governing law.

A virtual data room serves one transaction with many outside parties, while a client portal serves a continuing relationship between a firm and each of its clients. The table shows where they differ: in direction, in lifetime and in what the record is for.

The two are therefore rarely interchangeable. A portal built around one client per matter is usually not designed to keep rival bidders apart.

A virtual data room controls access through individual accounts placed in groups, and it logs every action each account takes. Each bidder forms a group. For every folder or document, the administrator sets which groups can see it and whether they may only view it or may also print or download it. Viewed pages commonly carry a watermark with the reader's name and the time.

Disclosure is usually staged. The most sensitive material, such as prices and customer terms, is held back for the final bidder or shown only to a small named team. A bidder is often a competitor of the company being sold, so sellers take advice before they show it such material.

The activity record lists who opened which document, when and for how long, together with every upload, change of permission and answered question. It proves disclosure. It also supports the legal protection of confidential business information. The Trade Secrets Directive protects information as a trade secret only if it has been subject to reasonable steps to keep it secret (Article 2(1)).

The record identifies an account and not a person, so a shared login defeats it.

The GDPR applies in full, because a data room for a company sale almost always holds personal data. Employment contracts, payroll lists, customer files, shareholder registers and copies of identity documents all name living people.

Showing personal data to bidders is processing in its own right, so it needs a legal basis under Article 6(1). Data minimisation then limits how much is shown. Personal data must be adequate, relevant and limited to what is necessary for the purpose (Article 5(1)(c)). A table of roles and salary bands often answers an early question as well as a folder of named contracts would. Names can be redacted at first and restored for the final bidder, when fewer people have access.

The provider comes next. The company whose records are shown is normally the controller and the data room provider is its processor, so the contract and security duties of Articles 28 and 32 apply as they do to a secure client portal.

Location is the last point. Chapter V of the GDPR allows personal data to be transferred to a country outside the EU only under set conditions (Article 44). One route is a Commission adequacy decision for that country (Article 45). Another is appropriate safeguards, such as standard data protection clauses (Article 46). The question arises when the provider stores data outside the EU. It can also arise when a bidder's team opens the room from a third country.

A firm should require written answers before the first document is uploaded. It starts with everything it would ask the supplier of a secure client portal.

Four further questions are specific to a data room. Can permissions be set by group down to a single document, with viewing separated from downloading? Can a bidder that drops out be removed at once? Does the activity record cover every action, can the firm export it, and is it protected against alteration? Does the firm receive a complete archive of the documents, the questions and the record at the end?

The end of the room has a legal footing. Under Article 28(3), the processor contract must provide that the processor deletes or returns the personal data when the service ends, at the controller's choice, unless EU or national law requires it to be stored. A firm that runs rooms for its clients should also settle who holds the archive afterwards.