1. Define the fair-process objective
The board should state the transaction purpose, fiduciary objective, bidder need and harms that controlled access must balance. The immediate output is a fair-process memorandum with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine what access is necessary to test a credible proposal without compromising the company or other stakeholders. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
2. Classify the transaction context
The board should identify whether the company is public or private, regulated, competitively sensitive, auctioned or exposed to rival bidders. The immediate output is a transaction-context assessment with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine which legal, regulatory and process regimes apply before any non-routine disclosure. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
3. Put the board in control
The board should reserve information-access decisions to the board or a properly authorised committee supported by independent advice. The immediate output is a board access mandate with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine who has lawful authority to approve, condition, pause and revoke access. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
4. Create an independent decision structure
The board should appoint unconflicted directors or an independent committee with terms of reference, quorum, advisers and escalation rights. The immediate output is a independent committee charter with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether conflicted management has been removed from decisions affecting its bidder advantage. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
5. Map management conflicts
The board should record financial interests, bidder roles, financing relationships, confidential knowledge and decisions in which each executive must abstain. The immediate output is a conflicts and recusal register with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine where employment duties and buyer incentives diverge. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
6. Separate employee and bidder roles
The board should define which activities management performs for the company and which it performs for the buyer group, with separate advisers and systems. The immediate output is a dual-capacity protocol with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether corporate resources, time and authority are being used only for approved purposes. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
7. Define the information perimeter
The board should list requested datasets, fields, periods, owners, purposes, sensitivity, legal basis and intended recipients. The immediate output is a information request register with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether every disclosure is relevant, proportionate and capable of controlled use. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
8. Build a staged access ladder
The board should sequence public information, management-held records, standard diligence, restricted data and exceptional disclosure through explicit gates. The immediate output is a staged-access plan with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine how diligence can progress with the least irreversible disclosure. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
Table 1. Staged information-access ladder
| Gate | Typical information | Primary control |
|---|---|---|
| orientation | public and management-owned records | purpose statement |
| credibility | standard commercial and financial data | bidder-readiness gate |
| restricted diligence | personal or sensitive operational data | redaction and role access |
| exceptional review | competition-sensitive or privileged-adjacent material | clean team or counsel |
Illustrative sequence; transaction-specific law and board decisions govern.
Values are illustrative readiness indices and require company-specific evidence.
9. Set a bidder-readiness gate
The board should require a credible thesis, buyer group, financing plan, advisers, timetable, confidentiality package and indicative proposal before deeper access. The immediate output is a bidder-readiness certificate with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether the proposal is sufficiently serious to justify incremental disclosure risk. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
10. Execute confidentiality protections
The board should document purpose limits, recipients, permitted use, disclosure routes, security, compelled disclosure, standstill, remedies and survival. The immediate output is a confidentiality agreement schedule with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether contractual controls match the sensitivity and life of the information. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
11. Protect legal privilege
The board should segregate privileged advice, identify privilege owners, avoid waiver and provide approved summaries where appropriate. The immediate output is a privilege control log with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine which legal analyses should remain withheld, redacted or disclosed only through counsel. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
12. Classify inside information
The board should assess precision, non-public status, price significance, issuer connection and combinations of facts under the applicable market-abuse regime. The immediate output is a inside-information assessment with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether a proposed disclosure creates market conduct obligations or trading restrictions. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
13. Control wall-crossing
The board should define the disclosure rationale, recipient consent, warnings, restrictions, records and cleansing process for any wall-crossing. The immediate output is a wall-crossing record with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether selective disclosure is necessary, authorised and supported by the required safeguards. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
14. Maintain recipient and insider records
The board should record who received which information, when, in what capacity, through which device and subject to which restrictions. The immediate output is a recipient and insider ledger with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether the company can reconstruct possession and obligations after a leak or regulatory inquiry. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
15. Log every access event
The board should capture uploads, views, searches, downloads, prints, exports, questions, changes and administrator actions. The immediate output is a immutable access log with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether anomalous activity and unauthorised propagation can be detected promptly. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
16. Apply data minimisation
The board should remove fields, periods and identifiers that are unnecessary for the stated diligence question and use aggregation where it preserves analytical value. The immediate output is a minimisation decision record with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether a lower-risk dataset can answer the same commercial question. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
Table 2. Sensitivity and handling matrix
| Information class | Main risk | Handling route |
|---|---|---|
| inside information | market abuse and leakage | controlled wall-crossing |
| personal data | unlawful or unfair processing | minimised approved sharing |
| competition-sensitive data | coordination or misuse | clean-team analysis |
| privileged advice | waiver and legal prejudice | withhold or counsel summary |
Illustrative classification; authorised advisers determine treatment.
Values are illustrative readiness indices and require company-specific evidence.
17. Establish a personal-data basis
The board should identify lawful basis, purpose compatibility, transparency, retention, security, processor roles and international transfer conditions. The immediate output is a personal-data sharing assessment with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether personal data can lawfully and fairly enter the diligence process. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
18. Protect employee information
The board should stage workforce disclosures from aggregates to role-level and individual data, with special-category material separately governed. The immediate output is a employee-data protocol with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine which employment information is necessary at each stage and who may see it. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
19. Protect customer and supplier information
The board should use anonymisation, aggregation, sample contracts and clean-team review before named counterparty disclosure. The immediate output is a counterparty-data protocol with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether commercial diligence can proceed without exposing relationships or facilitating solicitation. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
20. Identify competition sensitivity
The board should classify current and future prices, costs, volumes, capacity, strategy, customer terms, bids and other competitively sensitive information. The immediate output is a competition sensitivity matrix with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine which information could alter competitive conduct if received by management bidders or their backers. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
21. Design the clean team
The board should appoint independent advisers or ring-fenced personnel, define eligibility, systems, outputs, conflicts, reporting and removal rules. The immediate output is a clean-team charter with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether restricted analysis can be conducted without disclosing raw sensitive information to decision makers. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
22. Govern clean-team outputs
The board should pre-approve aggregation, ranges, commentary, escalation and release criteria for reports leaving the clean team. The immediate output is a output release log with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether analytical usefulness is preserved without reconstructing restricted source data. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
23. Control lender information packs
The board should distinguish company-generated material, bidder assumptions and adviser analysis, and document approvals before financing circulation. The immediate output is a financing information schedule with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine which materials may be shared with debt and equity providers and on what terms. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
24. Map finance-provider access
The board should identify recipients, syndication routes, potential competitors, conflicts, onward disclosure and destruction obligations across funding sources. The immediate output is a finance-recipient map with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether funding diligence enlarges the information perimeter beyond the approved buyer group. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
Table 3. Clean-team recipient architecture
| Recipient | Raw restricted data | Permitted output |
|---|---|---|
| independent adviser | approved fields only | aggregated findings |
| management bidder | no | decision-useful ranges |
| finance provider | limited approved subset | underwriting case |
| independent committee | oversight access | approval and exceptions |
Illustrative roles; independence and conflicts require verification.
Values are illustrative readiness indices and require company-specific evidence.
25. Preserve equality between bidders
The board should record information supplied to each offeror and establish prompt review and release procedures where equal-information duties apply. The immediate output is a bidder equality ledger with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether management access creates an advantage that must be neutralised in a competitive process. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
26. Use vendor diligence strategically
The board should prepare independently reviewed financial, tax, legal, commercial and operational materials suitable for controlled bidder reliance. The immediate output is a vendor diligence pack with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether common verified information can reduce repeated access and inconsistent answers. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
27. Run a controlled Q&A process
The board should route questions through authorised administrators, classify them, remove embedded restricted facts and approve written responses. The immediate output is a diligence Q&A register with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether informal conversations are bypassing the approved access perimeter. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
28. Govern forecasts and models
The board should separate approved budgets, management estimates, bidder cases and adviser scenarios with version, assumption and reliance controls. The immediate output is a forecast provenance file with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether valuation inputs are authentic, consistently described and fairly made available. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
29. Control management presentations
The board should approve presenters, scripts, materials, attendees, questions, recording, follow-up and any new disclosure created in the meeting. The immediate output is a presentation control pack with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether oral access creates unlogged or unequal information. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
30. Control site and system access
The board should limit physical visits, demonstrations, system credentials, copying, photography and interaction with staff or counterparties. The immediate output is a site-access protocol with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether operational diligence exposes live systems, trade secrets or transaction confidentiality. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
31. Secure the data room
The board should apply least privilege, multifactor authentication, watermarking, encryption, regional hosting, device rules, backups and administrator separation. The immediate output is a data-room security standard with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether technical controls support the legal and process restrictions. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
32. Prepare for leakage
The board should define detection, containment, legal assessment, board escalation, regulatory analysis, market disclosure and stakeholder communications. The immediate output is a leak response plan with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether the company can act before misuse, rumour or loss of confidentiality compounds harm. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
Table 4. Information incident response
| Event | Immediate action | Decision owner |
|---|---|---|
| anomalous download | suspend and preserve logs | data-room administrator |
| accidental disclosure | contain and assess recipients | transaction counsel |
| market rumour | test confidentiality and disclosure duty | disclosure committee |
| competitive misuse | restrict access and preserve evidence | independent committee |
Illustrative response; legal and regulatory duties may require faster action.
Values are illustrative readiness indices and require company-specific evidence.
33. Record recusals and reasons
The board should minute conflicts, absences, advice, alternatives, proportionality, dissent, approvals and conditions for each material access decision. The immediate output is a decision evidence file with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether the process can be defended without relying on retrospective explanations. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
34. Verify outputs independently
The board should reconcile material disclosures to source records and use independent financial, legal, technical or commercial review where judgement matters. The immediate output is a disclosure verification certificate with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether management knowledge has been converted into accurate, supportable transaction evidence. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
35. Stress misuse by management
The board should test attempted extraction, selective use, employee pressure, customer contact, bid manipulation and use of corporate systems. The immediate output is a management-misuse scenario with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether controls identify and contain abuse by a trusted insider. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
36. Stress an information leak
The board should model accidental email, compromised credentials, downloaded files, press inquiry, rumour and price movement. The immediate output is a leak simulation with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether logs, authority and response routes operate at transaction speed. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
37. Stress a competing approach
The board should test the arrival of another bidder, an equality request, revised access, management recusal and timetable compression. The immediate output is a competing-bidder scenario with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether the process remains fair when exclusivity and information advantage are challenged. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
38. Stress financing dissemination
The board should trace information through lenders, credit committees, co-investors, insurers and prospective syndicate members. The immediate output is a financing dissemination scenario with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether onward recipients remain necessary, authorised and controllable. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
39. Prepare the approval and exit record
The board should verify final recipients, unresolved exceptions, disclosure history, return or destruction, retained regulatory records and post-deal migration. The immediate output is a information-process closing certificate with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether the entire lifecycle is evidenced from first request to final disposition. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
40. Issue the fair-process conclusion
The board should integrate authority, conflicts, purpose, proportionality, equality, privacy, competition, market conduct, security and incident readiness. The immediate output is a board fair-process conclusion with named owners, dates, source evidence, approval status and open exceptions.
The analytical objective is to determine whether the proposed access supports a credible bid while protecting the company and the integrity of the process. Reviewers should reconcile board authority, transaction rules, constitutional documents, confidentiality terms, data-room records, adviser work, security evidence, financing materials and applicable advice. Each access decision should state its purpose and minimum sufficient information.
The framework should allocate responsibility across independent directors, management, buyer representatives, company and bidder advisers, data-room administrators, clean-team members, finance providers, employees and regulators. Classification, recipients, controls, access duration, onward disclosure, monitoring, exceptions, incident response, return and destruction should be explicit.
Each gate should test necessity, proportionality, authority, conflicts, competitive fairness, privacy, market integrity, security and reversibility. Gaps remain until evidence is complete, advice is current, recipients are controlled and the company can explain why the disclosure served a legitimate transaction purpose.
Table 5. Fair-process approval certificate
| Certification | Evidence owner | Status |
|---|---|---|
| authority, conflicts and purpose | company secretary | evidenced |
| classification and recipient controls | legal lead | evidenced |
| fairness, privacy and competition | independent adviser | evidenced |
| security, logs and final disposition | process administrator | evidenced |
Illustrative gate; the board retains responsibility for its conclusion.
Values are illustrative readiness indices and require company-specific evidence.
References
- The Takeover Panel, Rule 21.3 Equality of information to competing offerors, https://code.thetakeoverpanel.org.uk/tp/rules/rule-21/rule-21-3.html
- The Takeover Panel, Rule 3.1 Independent advice, https://code.thetakeoverpanel.org.uk/tp/rules/rule-3/rule-3-1.html
- The Takeover Panel, Rule 2 Secrecy before announcements and announcement requirements, https://code.thetakeoverpanel.org.uk/tp/rules/rule-2.html
- The Takeover Panel, Rule 22 Offer-related arrangements, https://code.thetakeoverpanel.org.uk/tp/rules/rule-22.html
- Financial Conduct Authority, Inside information: how to identify, control and disclose, https://www.fca.org.uk/markets/market-abuse/inside-information-how-identify-control-disclose
- Financial Conduct Authority, Market Abuse Regulation, https://www.fca.org.uk/markets/market-abuse/regulation
- Financial Conduct Authority Handbook, DTR 2 Disclosure and control of inside information, https://handbook.fca.org.uk/handbook/DTR/2/
- Financial Conduct Authority Handbook, MAR 1 Market Abuse, https://handbook.fca.org.uk/handbook/MAR/1/
- Financial Conduct Authority, Market Watch 75, https://www.fca.org.uk/publications/newsletters/market-watch-75
- Financial Conduct Authority, Market Watch 83, https://www.fca.org.uk/publications/newsletters/market-watch-83
- Financial Conduct Authority, Primary Market Bulletin 52, https://www.fca.org.uk/publications/newsletters/primary-market-bulletin-52
- Competition and Markets Authority, Interim measures in merger investigations CMA108, https://www.gov.uk/government/publications/interim-measures-in-merger-investigations
- Competition and Markets Authority, Merger assessment guidelines CMA129, https://www.gov.uk/government/publications/merger-assessment-guidelines
- Information Commissioner's Office, Due diligence when sharing data following mergers and acquisitions, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/
- Information Commissioner's Office, Data sharing: a code of practice, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/
- UK Legislation, UK General Data Protection Regulation, https://www.legislation.gov.uk/eur/2016/679/contents
- UK Legislation, Data Protection Act 2018, https://www.legislation.gov.uk/ukpga/2018/12/contents
- UK Legislation, Companies Act 2006 section 172, https://www.legislation.gov.uk/ukpga/2006/46/section/172
- UK Legislation, Companies Act 2006 section 173, https://www.legislation.gov.uk/ukpga/2006/46/section/173
- UK Legislation, Companies Act 2006 section 175, https://www.legislation.gov.uk/ukpga/2006/46/section/175
- UK Legislation, Companies Act 2006 section 176, https://www.legislation.gov.uk/ukpga/2006/46/section/176
- UK Legislation, Companies Act 2006 section 177, https://www.legislation.gov.uk/ukpga/2006/46/section/177
- Financial Reporting Council, UK Corporate Governance Code 2024, https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/
- Financial Reporting Council, Corporate Governance Code Guidance, https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/corporate-governance-code-guidance/
- National Cyber Security Centre, Information for organisations, https://www.ncsc.gov.uk/section/information-for/organisations
- National Cyber Security Centre, 10 Steps to Cyber Security, https://www.ncsc.gov.uk/collection/10-steps
