M&A Vocabulary – Experts explain: Virtual Data Room

published on 15 September 2023 | reading time approx. 5 minutes

In this ongoing series, a number of different M&A experts from the global offices of Rödl & Partner present an important term from the specialist language of the mergers and acquisitions world, combined with some comments on how it is used. We are not attempting to provide expert legal precision, review linguistic nuances or present an exhaustive definition, but rather to give or refresh a basic understanding of a term and provide some useful tips from our consultancy practice.

What is a Virtual Data Room?

Simply put, a “Virtual Data Room” (further “VDR”) is an archive consisting mostly of sensitive documents and information that can be accessed online or via the Internet.

The VDR plays an important role, especially in M&A transactions and Due Diligence that usually accompanies them (being a thorough examination of the company to be acquired/sold in legal, tax and business terms).

M&A transactions in general and due diligence processes in particular inevitably involve the exchange of sensitive and confidential information between the parties involved, such as companies, investors, advisers and attorneys at law. The VDR offers them a secure platform for the exchange of such information. In practice, VDRs are usually provided by external providers, a huge number of which is now present on the market.

In general, the importance of VDRs has significantly increased within the last 10-15 years, which is due in particular to the considerably improved and rapidly developing technical possibilities. As a rule, this also applies to “smaller” transaction projects, although in the case of such transactions it is still common to provide data and information via an own exchange platform or USB data sticks, and not via an external provider.

Before VDRs became established, data had not been provided in a digital but in a physical data room, i.e. indeed, in the form of paper files in rooms that were accessible only to certain persons involved in the transaction. These rooms were located e.g. in the tax adviser’s or attorney at law’s office, or also directly in the premises of the company to be acquired. Access was only granted to the party interested in the acquisition and/or to its advisers. A precise record was then made of who had physically inspected which piece of information or document in the data room. All in all, this made the due diligence process, which was usually time-consuming anyway, (even) more time-consuming.

Compared to physical data rooms, VDRs offer a number of advantages:

Simultaneous access: Several persons interested in the acquisition can conduct a due diligence process at the same time without the necessity to set up parallel data rooms in different locations.
Time and location-independent access: VDRs enable users to access documents and information at any time from almost anywhere as long as internet connection is ensured. This eliminates the need for the involved parties to be physically present at a specific location.
Quick distribution of information: VDRs allow to upload, organise and share documents and information with authorised users quickly and efficiently; this is significantly quicker than physical distribution of paper documents. Moreover, using a VDR can speed up the due diligence process as a whole, as information can be shared and processed more quickly.
Real-time access control: In most cases, VDRs offer full access control. For example, it is possible to define, which user is authorised to access which documents.
Traceability: In addition, VDRs enable detailed tracking of user activities, including the frequency of access to documents and downloads. On the one hand, this enables transparency and helps to better monitor the actions of all users. On the other hand, an access log generated via the VDR can possibly be used in the event of a dispute where the knowledge of or the possibility to gain knowledge of certain information is the subject of dispute. Even though this is not sufficient for the seller to prove the buyer’s knowledge of possible defects, it definitely helps the seller along with furnishing this proof – which in practice is very difficult to do.
Security: VDRs usually offer higher security of confidential information than physical data rooms. Encryption, access logging and other security measures can ensure data protection.
Cost saving: Using a VDR may be more cost-effective because it reduces the need for physical rooms, printing costs and any other expenses relating to the setting up and maintenance of a physical data room.

What aspects require particular attention when using/setting up a virtual data room?

In order to make the use of a VDR effective, secure and as user-friendly as possible, the following aspects should be taken into consideration:

Precise usage rules for the VDR: Regardless of the size of a given transaction, the binding usage rules for the VDR should first be agreed between the parties.
Security and data protection: It should be ensured that the VDR is equipped with security measures such as data encryption, access control, multi-level authentication and protection against unauthorised access. It should also be regulated whether printing restrictions will possibly be set up for the documents made available in the VDR. This can serve as an additional safeguard ensuring confidentiality of the information available in the VDR.
Authorisations: It should be possible to define certain authorisations for (groups of) users. This feature allows to control access to certain documents or folders and, thus, the users’ individual roles and responsibilities can be taken into account accordingly.
Ease of use and document organisation: The VDR should be intuitive and user-friendly to make it as easy as possible for everyone to use. For example, we recommend a clear and well-organised folder structure, and a simple search function. A clear structure and labelling make it easier for users to quickly find the information they need. Users should also have the possibility to ask and manage their questions (e.g. regarding a requested but not yet provided document) via a dedicated tool (e.g. a digital Q&A list).
Traceability: The VDR should be able to log who has accessed which documents and when exactly this activity took place (as far as this is allowed under data protection law). Possibly the data material obtained in this way may be used in the event of a dispute where the buyer’s knowledge of certain due diligence information is contested.
Technical support: In addition, it should also be ensured that technical support is at hand to immediately provide support when problems or questions arise.
Compatibility: The VDR should be compatible with different file formats in order to ensure that users may access the information they need without any problems. Furthermore, sufficient storage space should be available to cover the needed data volume.
Data backup and recovery: The VDR should also be equipped with a function that ensures creating regular backups and with a reliable recovery function in order to ensure that data and information can be recovered in the event of a technical problem or data loss.
Compliance with the legal requirements: It must be ensured that the VDR complies with the applicable legal requirements, in particular regarding data protection and storage of sensitive information (e.g. how personal data and information relating to employees of the target are handled in the VDR).
Careful selection: If the VDR is to be provided and managed by a third-party provider, care should be taken to select this provider carefully so that the aforementioned aspects are sufficiently taken into account.

Conclusion

In summary, it can be stated that VDRs offer a number of advantages compared to physical data rooms and constitute a modern and adequate alternative to them, in particular in terms of efficiency, security and ease of use.

But regardless of whether you commission an external data provider or use a self-organised method for making documents and information available, you should always pay attention to ensure that the aspects explained above are sufficiently and appropriately taken into account.

From the Newsletter

M&A Dialogue

Contact

Contact Person Picture

Thomas Löhrer, LL.M. (Singapore)

Associate Partner

+49 221 9499 093 10

Send inquiry

How we can help

Transaction advisory | Mergers & Acquisitions