Commercial due diligence files: confidentiality, MNPI and what consultants keep

Why CDD files carry more restrictions than other consulting work#

CDD files carry more restrictions because the consultant sits inside a chain of confidentiality agreements it did not fully negotiate. The sponsor signs an NDA with the seller or its banker to enter the data room, and the consultant typically signs a joinder, a separate NDA or a release letter to see the same material.

The deal may not close, a rival bidder may win, and the target may belong to another sponsor. Each outcome changes who cares about the files. Lenders may also rely on the report under reliance letters, adding another party with an interest in what the firm keeps.

Engagement letters for CDD work tend to carry tighter use restrictions, liability caps and non-reliance terms than ordinary consulting agreements. Read them before anything from a deal goes into the firm's knowledge base or templates.

Record classes and the default rule for each#

The safest way to manage CDD files is by record class, with exclusion from any reuse as the default until counsel clears a class. The table shows common classes and their usual treatment.

Sponsor data deserves particular care. A bid price, a debt structure or an investment committee's view of the target's weaknesses can do more harm in the wrong hands than the target's own KPIs, and the sponsor rarely expects any of it to leave the engagement team.

When does CDD information become MNPI?#

CDD information can become material nonpublic information when a public company is involved, whether as the target, the seller, a bidder or a company whose results the work reveals. Knowledge of an unannounced acquisition, or of a listed company's unreleased performance, can be material, and securities laws restrict trading on it or passing it to others.

Most private equity CDD concerns private targets, but the exposure appears more often than partners expect: a carve-out from a listed parent, a take-private, a public competitor whose customer data surfaces in interviews, or a sponsor or target with publicly traded debt. Firms doing this work typically keep a restricted list, pre-clear personal trading and log who was brought over the wall.

Whether a given fact is MNPI is decided case by case with compliance and counsel, not by the engagement team.

NDA terms that decide what you may keep#

The NDA terms that decide retention are usually scattered across the sponsor NDA, the joinder and the engagement letter. Pull all three before the close-out rather than relying on the one the team remembers.

• 1Use restriction: information used solely to evaluate the transaction.
• 2Return or destroy: timing, certification requirements and who may demand it.
• 3Retention exceptions: copies kept for legal or regulatory compliance, and copies in automatic backups.
• 4Non-solicitation: limits on approaching target employees or customers met during diligence.
• 5Term: how long confidentiality survives, sometimes longer for trade secrets.
• 6Residuals: whether general knowledge retained by the team may be used later.

A close-out sequence for deal files#

A close-out sequence turns NDA terms into steps the team can verify. Run it when the sponsor signs, withdraws or loses the auction, and record each step in the engagement file so a later certification request can be answered from the record.

Email and sync folders are where close-outs usually fail. Data room downloads attached to emails, synced to personal OneDrive folders or pasted into chat threads survive a shared-drive deletion, so the checklist should name every location the team actually used.

• 1Step 1: confirm the deal outcome and any return or destroy request in writing.
• 2Step 2: delete data room downloads from laptops, shared drives, email and collaboration tools.
• 3Step 3: strip target and sponsor data from models and save a clean template version.
• 4Step 4: move the report, engagement letter and reliance letters into a restricted archive.
• 5Step 5: record what was kept under retention exceptions and who certified destruction.
• 6Step 6: remove the deal from the restricted list once compliance clears it.

Illustrative: a strategy boutique cleans up its deal sites#

Illustrative: a fictional strategy boutique runs buy-side CDD for mid-market sponsors. Each deal lives in its own SharePoint site with data room downloads, expert call transcripts, Excel market models and the final report.

The firm wants an internal AI search tool across past work. The general counsel blocks indexing of whole deal sites. Instead, a small team builds a template library of market sizing structures, customer survey instruments and interview guides, each rebuilt without target names, figures or quotes.

Expert transcripts stay out because the network's terms limit use to the project the call was booked for. Older deal sites, where return-or-destroy certifications were never completed, go through the close-out sequence before any other work on the archive begins.

How SourceX handles deal-related records#

SourceX handles deal-related records with default exclusion. In the Rights step of the SourceX five-step transaction (Supply, Rights, Preparation, Approval, Delivery), target data, sponsor data and expert material are out of scope unless documents show a clear right to license them, which is rare. What can qualify are firm-authored materials such as methods, templates and internal project reviews written without deal information.

Each approved package is documented in a SourceX Evidence Packet with provenance, licensing rights, permitted use, the privacy record and release authorization, so the firm can show any future sponsor exactly what was and was not included. The initial fit check collects metadata only, so no deal file is shared to find out whether anything qualifies.