In a merger and acquisition (M&A) transaction, due diligence always contains a paradox: to decide whether to buy a business and for how much, the buyer needs to know as much as possible; but to protect its business, the seller needs to control as tightly as possible what is disclosed.
One point to distinguish from the outset is that "confidential information" and "trade secrets" are not completely identical.
This contradiction is especially evident when the information required is not only a license, contract or financial statement, but also includes customer lists, pricing policies, profit margins, production formulas, technological processes, business strategies or product development plans. These can be the intangible assets that create a business's competitive advantage. The risk is even greater if the buyer is a competitor or the final deal is not completed: documents can be returned, access to the data room can be closed, but what is known is not easily "erased" from perception.
So the key question in M&A isn't simply whether to disclose information. The real question is: who knows, what is known, when, for what purpose, and how can the seller prove those limitations if the transaction fails?
1. Not all confidential information is a trade secret
One point to distinguish from the outset is that "confidential information" and "trade secrets" are not completely identical. In an M&A transaction, the scope of confidential information can be very broad: draft contracts, undisclosed financial statements, personnel information, investment plans, operational data, or even the existence of the transaction itself. The parties can agree to keep this information confidential even if it does not necessarily meet the conditions for legal protection as a trade secret.
According to the Intellectual Property Law, a trade secret is information obtained from financial and intellectual investment activities, which has not been disclosed and is capable of being used in business[1]. To be protected, information must be simultaneous: not common knowledge and not easily obtained; when used in business, it is likely to give the holder an advantage over the person who does not hold or does not use it; and is kept confidential by the owner by necessary measures so that the information is not disclosed and not easily accessible.
The last condition is especially important in M&A. A business cannot simply label a document "Confidential" and implicitly assume that it is protected as a trade secret. How a business manages access, classifies documents, signs confidentiality agreements, controls downloads, and saves access history can all become important factors in proving that the business has actually treated the information as a secret.
2. The biggest risk that can appear when the deal fails
In the process of Due Diligence, the buyer can access the amount of information that is almost impossible in normal business conditions such as: price structure, profit margins, large customers, trade conditions with suppliers, technology, product plans, market strategies and even strengths and weaknesses in the operation of the target business.
If the deal goes through, many of those risks are significantly reduced because the buyer becomes the owner or control of the target business. But if the deal fails, the buyer may not own the business and still have a pretty good understanding of how it operates. The risk is especially noteworthy when the buyer is also a competitor: information about the customer, the selling price, the cost, the bidding strategy or the market development plan can create a significant advantage if used outside of the purpose of evaluating the transaction.
Intellectual property law and competition law both set out mechanisms for unauthorized access, collection, disclosure or use of confidential information in business. However, having legal regulations does not mean that handling disputes will be simple. The seller may still have to prove which information is confidential, how it has protected it, who has accessed it, how the unauthorized use occurred, and where the damage arises.
3. When the buyer is a competitor, the problem is not just a trade secret
A transaction between businesses that are or is likely to compete with each other poses a more complex risk. If the buyer requests detailed data on each customer's selling price, discount rate, profit margin, price increase plan, production capacity, tender strategy, or future business plan, this information may be necessary for the valuation of the business but may also be sensitive information about competition.
If such information is passed on directly to a competitor's sales, sales or valuation team before the transaction is completed, the problem is no longer just the risk of losing trade secrets but also needs to be considered from the perspective of competition law. Therefore, for highly sensitive transactions, parties can establish a limited access to information (clean team) mechanism consisting of lawyers, financial advisors, or personnel who are not directly involved in competitive decisions in the market who have access to sensitive data.
This team can analyze the data and only provide buyer decision-makers with results that have been aggregated, anonymized, or removed unnecessary sensitive details. This mechanism helps reconcile two benefits: the buyer still has enough data to evaluate the transaction, while the seller does not have to directly pass on all sensitive competitive information to its own competitors.
4. NDA is necessary, but not enough
A non-disclosure agreement (NDA) should be signed before the seller begins to provide important information. However, the value of an NDA lies not in the name but in the way the confidentiality obligation is designed. The NDA should define the scope of confidential information, limit the purpose of use to the evaluation of the intended transaction, and control the use of the information to compete, reach customers, suppliers, or personnel of the seller.
NDAs also need to identify who is allowed to access the information. In practice, the information can reach lawyers, accountants, banks, financial advisors, technical consultants, affiliates, and employees of the buyer. Therefore, the scope of the guarantee and the buyer's responsibility for the conduct of these people should be clearly defined. Another issue that is often overlooked is that the information remains in the memory of the people who have accessed the document. If the NDA allows the recipient to freely use the knowledge retained in memory after the document is returned or destroyed, the effectiveness of the protection may be significantly impaired.
The obligation of confidentiality also does not necessarily apply to the same period of time for all information. For ordinary confidential information, the parties can agree on a specified period of time. But for core business secrets such as formulas, algorithms, or know-hows, consideration should be given to maintaining the obligation for as long as the information remains confidential in accordance with the agreement and applicable law.
The sanctions mechanism must be formulated in accordance with the law governing the contract. Penalties for breaches, compensation for damages, and measures to require the termination or prevention of infringement should not be mechanically copied from foreign NDA forms. For instance, if the Commercial Law of Vietnam is applied, the penalty for breach is limited in principle under Article 301 of this Law, while compensation for damages is governed by its own legal conditions. Therefore, mechanisms commonly encountered in common law contracts such as liquidated damages or injunctive relief should not be copied mechanically, but should be designed in accordance with the law governing the contract and the dispute resolution mechanism chosen.
A common mistake is to design the Due Diligence process with the assumption that the transaction will eventually be completed.
5. Don't reveal it all at once
A good NDA still cannot replace information control. An important principle in M&A is "need-to-know"[2]: the buyer should only have access to the amount of information necessary for the decision at each stage. At an early stage, the seller can provide aggregated or anonymized information; as the transaction goes deeper, the scope of the information can be expanded; and particularly sensitive data should only be provided at the appropriate stage, to the appropriate group of people or through a special team. This is a staged disclosure approach, rather than opening up the entire data in the first place.
A good Virtual Data Room (VDR) is also more than just a place to upload documents online. Features such as user-based permissions, download or print restrictions, user authentication, access durations, activity logs, and access revocation permissions help sellers control the lifecycle of information. For particularly sensitive documents, businesses can also use tools to anonymize customers, aggregate data, or just allow them to be viewed without downloading. These measures both reduce the risk of information misuse and create a trail of evidence that the business has applied practical measures to protect confidentiality.
6. Be prepared for a failed trading situation from the beginning
A common mistake is to design the Due Diligence process with the assumption that the transaction will eventually be completed. But it is only when the transaction fails that the security mechanism is tested. NDAs should therefore clearly address the consequences of termination negotiations: access to the data room must be closed; documents and copies must be returned or destroyed according to the agreed mechanism; where appropriate, the recipient must confirm the destruction; and the obligation of confidentiality continues to exist for the agreed period.
For particularly sensitive information, businesses should also keep evidence of who was granted access, what documents were opened or downloaded, and when. When a dispute arises, the seller may have to prove a series of issues: whether the information meets the conditions of a trade secret; whether it has legal rights to the information; what security measures have been applied; what information has been accessed by the buyer or related party; whether there has been unauthorized use or disclosure; and what damages have actually been incurred. An email requesting confidentiality is unlikely to create the same status as a system of NDAs, document classification, limited access, VDR logs, and a set of rules for access to confidential information established from the beginning.
7. Protecting business secrets must start before opening a data room
M&A is a special process because the business has to give a non-owner a look at the deepest parts of the business to convince them to become the owner. Therefore, the risk of trade secrets does not begin when the information is stolen. It starts from the moment the business voluntarily gives access to the information to a party that is unlikely to become a buyer.
NDAs are the first layer of protection, but they should not be the only one. An effective mechanism should combine at least three layers: contractual protection, control of access to and use of information, and maintaining evidence of the entire disclosure process. For transactions where the buyer is a competitor, an additional layer of control over competing sensitive information should be added through staged disclosure, data anonymization or aggregation, clean teams, and appropriate access limits.
Ultimately, protecting business secrets in M&A doesn't mean keeping everything private. A transaction won't go ahead if the buyer doesn't have enough information to evaluate the business. It's important for businesses to know what information to disclose, to whom, when, and within what limits. An M&A deal can be stopped, but information that has already been disclosed can't always be retrieved.
