Data room due diligence is the buyer's review of the documents a seller places in its virtual data room: corporate records, financial statements, customer and supplier contracts, leases, financing papers, tax filings, environmental surveys and employment files, read before signing to find anything that should change the price, the protections in the purchase agreement or the conditions to closing. It is hard because a mid-market buyout room runs to thousands of files in the seller's languages, the reading is split among outside advisers who each see a slice, and files keep arriving until the last week. Botminds' Virtual Data Room Due Diligence puts eight agents on the whole room, explains every file not yet read and cites every red flag to its folder and page, so a deal team can tell its investment committee what the review covered as well as what it found.
Take a fictional sample deal as it runs through the solution: Quillfield Private Equity Fund V is buying Skarvik Logistik AB, a Swedish contract-logistics company with SEK 4,520 million ($429 million) of revenue, in a deal called Project Fjord. The seller's room opened on Monday 12 October with 5,418 documents. The firm, the target, the people and every figure about them are sample data, not a customer's result; the research figures come from courts, regulators and peer-reviewed studies, linked where they appear.
One sample room, measured a week after it opened
5,418files
in the seller’s room: 61,240 pages in six languages
56unread
on the morning of 19 October, each with a stated reason
41of 47
red flags sized by an agent from a second workstream; six still being checked
46hours
from access to the first full read and the first cited red-flag report
What is in a due diligence data room?
A due diligence data room holds whatever the seller chooses to disclose, filed under the seller's own index. In the sample room that index has eleven numbered top-level folders, and the file counts are uneven in a way that matters: the material contracts folder alone holds 1,236 files, almost a quarter of the room, while the litigation, compliance and data protection folder holds 296.
Where the sample room's 5,418 files sit, folder by folder
File counts are a poor guide to where the work is. Inside material contracts, the customer contracts subfolder (4.2) holds 412 files, and a single one of them, the Nordhavn Retail Group master agreement at 4.2.17, carries the clause that later becomes the deal's largest price item. The financial information folder is smaller but denser: the quality-of-earnings databook, revenue by customer and the budget sit there, and they are what size a contract's risk. Tax holds only 388 files, yet three of them are password-protected transfer-pricing files that no one in the deal team can open.
The languages are the second dimension. The sample room is 2,941 Swedish documents, 1,688 English, 342 Norwegian, 251 German, 164 Polish and 32 Danish. A reviewer who reads only English sees under a third of it, and the files that need translation are not evenly spread: the local customer contracts, the leases and the employment files are where the seller's own language dominates.
How do you review a data room? Index, triage, read, then cross-check
A data room is reviewed in four passes: an inventory of what is there, a triage of each file to the workstream that should read it, the reading itself, and a cross-check that joins findings across workstreams. Done by hand, the associate exports the index, splits it into folders for outside counsel, the financial and tax adviser, the commercial, ESG and HR advisers, and each adviser keeps its own tracker. The weakness is not effort. It is that no one owns the denominator: each tracker counts what its adviser read, and nobody counts what nobody read.
In the solution the Intake agent does the inventory and triage for the whole room. It connects to the seller's room read-only, extracts text from scans, detects the language, translates, collapses exact copies and classifies each file to the workstreams that must read it; the workstream agents then read. Every stage is counted, so a drop between stages is visible rather than silent.
From received to read: every stage counted, so a gap shows
The intake screen: where each file is, and why the unread ones are unread
Why a page count says little about the quality of diligence
The best large-sample evidence on diligence depth uses time, not pages, and it points one way. Studying public acquirers, Daniel Wangerin measured diligence by the time taken to negotiate the agreement and complete the deal, and found that "less due diligence is associated with lower post‐acquisition profitability, a higher probability of acquisition‐related goodwill impairments, and lower quality fair value estimates for the acquired assets and liabilities" (Wangerin, Contemporary Accounting Research, 2019). The same study found that competitive pressure is one of the forces "associated with less due diligence", which is the position a buyer in an auction is usually in.
Depth is not the same as coverage, and one Delaware case shows why both matter. In 2017 Fresenius Kabi agreed to buy Akorn after a diligence that the top executive of its parent company, on an earnings call in February 2018, called "the most intensive and comprehensive that I have experienced during my time at Fresenius". He added that "when you wish to acquire a competitor, there are restrictions", and that "[t]here are areas where you simply are not allowed to look, including product development and drug approval processes". The Court of Chancery found that the final presentation to Fresenius's supervisory board "did not identify risks related to data integrity", the problem that later supported the buyer's termination of the deal (Akorn v. Fresenius Kabi, Del. Ch., 1 October 2018).
The lesson for a deal team is not to read more pages. It is that a diligence file should state what was read, what was not, and what could not be looked at, so the committee knows where the evidence ends. A total such as "5,000 pages reviewed" hides all three.
How do you know what has been reviewed? Five measures of coverage
You know what has been reviewed when every file in the room has one of two states, read or explained, and when the findings have been joined across workstreams. Five measures capture that, and each can be computed from a tracker that is kept honestly; none needs software, though software makes them cheap.
Five coverage measures an investment committee can ask for
- Read or explained, by folder
Files read plus files with a stated reason, over files received, folder by folder. The target is 100%; anything less is a file nobody has accounted for.
- Unread files by reason
In progress, unreadable scan, locked or password-protected, withheld by the seller, fenced to the clean team. Each reason has a different next step.
- Late uploads caught
Files added after the first full read, and how many of them were read before the report went out. A room is a moving target until signing.
- Flags sized by a second workstream
The share of red flags checked by a reader from another workstream, such as legal findings sized against the revenue file. In the sample: 41 of 47.
- Flags with both citations
The page where the problem sits and the page that sizes it. A flag with one citation is a finding; a flag with two is a number the committee can use.
The fourth and fifth measures are the ones most often missing, and they are where price-moving findings live. A legal reader who finds that a customer may terminate on a change of control has half a finding. Whether it matters depends on that customer's share of revenue, which sits in the financial folder, in a workstream another adviser is reading. The change of control clause sized by the revenue behind it works through that join on the sample deal, where the customer turned out to be 23.0% of revenue.
The 56 files nobody had read yet, and why each mattered
On the sample morning, 56 of 5,418 files were unread, and every one had a reason that pointed to a next step. Forty-one had arrived at 07:12 that day, 29 of them in the seller's Q&A log and 12 in the budget folder; 26 had already been read. Twelve were scans whose first pass came back below 92% text confidence and were being re-read at 600 dpi. Three were password-protected transfer-pricing files, which the Intake agent cannot read, so it drafted a question to the seller asking for them.
The 56 unread files: three reasons, three different next steps
Unread on 19 October · 56 files
- New uploads, being read · 41 · 73%
- Scans re-read · 12 · 21%
- Locked · 3 · 6%
Unread files are not a random sample of the room. The twelve weak scans were eight environmental surveys and four employment contracts: old, signed, photocopied paper, which is where site contamination and individual employment terms are recorded. The locked files were transfer pricing, where tax exposure across borders is documented. A review that silently skips the hard-to-read files skips the files most likely to carry a finding, which is why the second measure, unread by reason, matters more than the first.
What happens to late uploads in a data room?
Late uploads are normal, and a review has to treat them as part of the room, not as an appendix. Sellers add files as they answer the buyer's questions, update the budget, or produce documents a question uncovered. The FTC's competition staff, writing about what sellers should check before sharing, told them to examine materials made available to bidders "including schedules later added to data rooms" (FTC Bureau of Competition, 20 March 2018). If the seller is expected to review its late additions, the buyer should expect to read them.
In the solution the seller's room is re-read every 15 minutes, and new files go through the same pipeline as the first 5,418. The effect is easiest to see on an open flag. Flag F-32 had asked for a missing German trade-tax return; when the return appeared in the room overnight, the Questions agent read it and proposed closing the flag. The deal lead still decides. What changes is that a late file reaches the person who needs it the morning it arrives, rather than when someone next refreshes an index export.
What is a data room index, and why is it not a reading plan?
A data room index is the seller's numbered table of contents: folders, subfolders and documents, each with a reference such as 4.2.17 for the seventeenth customer contract. It is the right address system and the wrong reading plan. The index tells you where a document is filed; it does not tell you which documents answer the questions that move the price, and those answers are usually spread across folders. A customer concentration question needs the customer contracts in 4.2, the revenue file in 2, and the seller's answers in the Q&A log.
Keep the seller's numbering for citations, because it is what both sides and every adviser can find. A flag cited as "4.2.17, page 12, Swedish original" can be opened by the seller's counsel, the buyer's counsel and the committee alike. Then build the reading plan from the buyer's own questions, a method set out in reading the room by your questions rather than the seller's index.
The seller's folder tree, with a reading bar on every folder
What do the rules expect of a due diligence file?
No rule sets a page count, but several expect a documented process and a file that shows it was followed. In the EU, a fund manager must run a documented diligence process, kept up to date and suited to the fund (AIFMD, Article 15(3)(a)). For assets of limited liquidity bought after a negotiation, which describes a buyout, the implementing regulation adds the content and the retention.
What each rule asks of a buyer's diligence file
| Source | What it says | What it means for the file |
|---|---|---|
| AIFMD Article 15(3)(a) (EU) | “an appropriate, documented and regularly updated due diligence process” | A written process, kept current, that the deal team can show it followed. |
| Delegated Regulation 231/2013, Article 19(1)(c) (EU) | Assess every legal, tax, financial or other factor that affects value | Every workstream, not only the ones an adviser was hired for. |
| Article 19(1)(d) | “perform due diligence activities related to the transactions prior to arranging execution” | The reading happens before signing, not as a post-closing clean-up. |
| Article 19(2) | “retain records of the activities carried out pursuant to paragraph 1 for at least five years” | The trail of what was read and decided is kept, not only the final report. |
| SEC staff, Risk Alert, January 2022 (US) | Advisers whose fund disclosures described a diligence process, but whose policies were not fitted to their own business | If investors were told how diligence is done, the file must show it was done that way. |
| Advisers Act Rule 204-2(a)(7) and (e)(1) (US) | Written communications relating to advice given or proposed, kept “not less than five years” | Seller questions, adviser reports and the red-flag report are books and records. |
The SEC staff's wording is the sharpest test for a US adviser. Its 2022 alert grouped "due diligence failures relating to investments or service providers" among its main observations, and described advisers whose disclosed process and actual practice had drifted apart. A coverage statement is the cheapest evidence that they have not: it shows, deal by deal, that the room was read the way the policy says it is read.
The coverage statement: one line the committee can test
A coverage statement is a single sentence at the end of the red-flag report saying how much of the room was read or explained, as at which date and time, with the unread files listed by reason. In the sample it reads "5,418 of 5,418 documents read or explained", and each of the 56 explained files is listed beneath it with its reason. A committee member can test it by asking for any folder and seeing its bar.
The statement also dates the report. The first version in the sample was issued on 14 October, 46 hours after access, with the first full read; version two followed on 16 October with 24 decisions, and version three on 19 October with 33. Each version carries its own coverage line, so the committee can see the room growing and the reading keeping up. How the rest of the report is structured, flag by flag, is set out in the guide to writing a red flag report an investment committee can act on.
What the solution does not do is decide what a finding means. Agents read, translate, flag and cite; the deal lead accepts or rejects each flag with a reason code, and legal counsel co-signs the report. To see the room, the coverage panel and the report together, start from Virtual Data Room Due Diligence.
Questions people ask
What is a virtual data room in due diligence?
It is the secure online repository where a seller places the documents a buyer may review, organised under the seller's index and governed by the seller's access rules. Buyers, their advisers and any clean team are given access under a confidentiality agreement, and the room usually logs who viewed what. It holds the evidence; it does not read it or say what was missed.
Can you download documents from a data room?
Only if the seller allows it. The FTC's staff suggested that sellers consider "prohibiting individuals with data room access from downloading or e-mailing confidential information in the data room" where competitively sensitive data is involved. In the sample, the room is view-only and the solution keeps its extracted text in the buyer's own EU region.
What happens to data room documents if the deal fails?
The confidentiality agreement decides, and it usually requires return or destruction. FTC staff listed, among the safeguards, making bidders destroy their own internal analysis built on the confidential data; the clean team guide covers the rest. In the sample, the setting destroys seller material within 30 days of a deal ending and issues a destruction certificate.
How many documents are in a typical data room?
No regulator or independent study publishes a typical count, and rooms vary with the target's size, age and number of countries. The sample room holds 5,418 documents and 61,240 pages in six languages. Count your own last three rooms by folder and language; that is the only benchmark that predicts your next one.
Is a data room due diligence checklist enough?
A checklist tells you what should be in the room and which questions to ask; it does not show what was read. Pair it with the coverage measures above: read or explained by folder, unread files by reason, late uploads caught and flags sized by a second workstream.
Who has access to the data room during due diligence?
The seller decides, usually the buyer's deal team, outside counsel and named advisers, with competitively sensitive folders limited to a clean team. In the sample, outside advisers see only the questions in their own scope, and every view of a fenced page, including one blocked attempt, is logged.