A virtual data room is a secure online repository used to share confidential documents with a limited group, most often during a sale, investment, merger or legal process. Unlike a normal shared drive, it controls exactly who can see, print or download each document, and it records everything they do.
- Fine-grained permissions per user, folder or document
- Audit trails of who viewed, downloaded or printed what, and when
- View-only controls and watermarks, so documents can be read but not copied freely
- A Q&A module, which keeps buyers' questions and your answers in one place instead of scattered across email
- Indexing and bulk upload, with folder structures that mirror a due diligence checklist
- Automatic access expiry, so people lose access when the deal ends
Where they are used
Virtual data rooms are mostly used for due diligence in mergers and acquisitions, but also for fundraising, property transactions, board materials and any process where sensitive documents go to outside parties.
The virtual data rooms market
The virtual data rooms market includes specialist providers built around deal workflows, and general cloud platforms that offer lighter data room features. Reports on the size and growth of the virtual data rooms market vary widely between research firms, and many are produced for vendors, so treat headline growth figures with caution. What matters when you are buying is fit: how many deals you run, how many outside parties need access and what your advisers already use.
What to check
| Check | Why it matters |
|---|---|
| Security | Encryption in transit and at rest, strong access controls, two-factor sign-in, and independent certifications such as ISO 27001 |
| Data location and UK GDPR | Due diligence files often contain employee and customer personal data, so check where it is hosted and processed |
| Pricing | Whether it is charged per page, per user, per project or as a flat fee, and what happens to storage after the deal closes |
| Ease of use | Outside parties rarely accept training, so set-up and navigation should be obvious |
| Support | Whether help is available during your deal hours |
| Exit | Archive and export at closing, and how long the provider keeps your data |
Running one cleanly
- Build the folder index before you upload anything.
- Remove or redact personal data the other side doesn't need to see.
- Set permissions by bidder or adviser group rather than person by person.
- Use the Q&A tool instead of email, so the record is complete.
- Archive the room and revoke access when the deal closes.
For everyday file sharing, see our guide to cloud storage for business in the UK. For records you must keep long term, see document management systems, and for the wider picture, business security solutions.