Global M&A hit about $2.8 trillion in the first half of 2026, up 48% on a year earlier, according to LSEG data. That made it the strongest first half since records began in 1980. Yet deal count fell about 9%. Fewer, bigger deals now carry more scrutiny per deal.
That scrutiny lands in the virtual data room. A Bayes Business School study of more than 900 deals found that average due diligence time rose from 124 days to 203 days between 2013 and 2023. Every extra week runs through the data room.
This guide gives you a complete virtual data room checklist for 2026. It covers the room from the first NDA to the closing archive, for both the sell side and the buy side.
Quick answer: A virtual data room (VDR) checklist covers six stages: choose the platform, build the folder index, upload and redact documents, set permissions by bidder and workstream, run the Q&A process, and archive the room at closing. Sell-side teams build and manage the room. Buy-side teams map their diligence request list to it and track every open item to close.
What Is a Virtual Data Room in Due Diligence?
A virtual data room is a secure online platform where a seller shares confidential documents with buyers and their advisors during an M&A transaction. Common providers include Datasite, Intralinks, Ansarada, Firmex, iDeals and DealRoom.
Here is the data room in plain terms:
- A seller builds the data room before the buyers arrive.
- A data room stores the documents buyers need to test the deal.
- A data room index organizes those documents into numbered folders.
- Permissions control which bidder sees which folder.
- The Q&A module routes buyer questions to the right expert.
- The audit log records every view, download and print.
- The closing archive preserves the room for future claims.
A VDR differs from a shared drive in three practical ways. It tracks every action by user. It applies watermarks and view-only controls. And it runs a structured Q&A process, so every answer stays on the record.
Why Does the Data Room Matter More in 2026?
The data room now shapes deal value long after signing.
Representations and warranties insurance (RWI) shows it clearly. Aon’s 2026 Global Claims Study found that its North American clients recovered more than $440 million in R&W payments in 2025. The median payment rose to $8.2 million, up from $5.5 million in 2024. Breaches of financial statement representations drove 38% of total losses.
Aon’s claims leaders see the pressure building:
“The global claims environment is evolving rapidly, as rising claim frequency, increasing severity and shifting notification patterns impact the M&A insurance landscape.” Stephen Davidson, Global Head of Transaction Solutions Claims, Aon
Martijn de Lange, who leads Aon’s Transaction Solutions team in Asia Pacific, tied those outcomes to the deal process. He pointed to the quality of diligence, financial analysis, and post-completion integration as key drivers of claim results, alongside policy coverage.
Timing matters too. About 51% of R&W claims arrive more than 12 months after closing, often after the seller’s escrow has expired. When a claim arrives, both sides go back to the data room to prove what the buyer knew. A clean, complete archive decides those arguments.
AI adds another layer. Datasite’s 2026 report, The New Deal Team, surveyed 1,000 senior dealmakers in 27 countries. It found that 62% of them believe human-only decision-making is no longer defensible in complex transactions. Modern VDRs now use AI to auto-index uploads, suggest redactions, and summarize documents. Those tools work only as well as the room’s structure.
Our take: Treat the data room as evidence. Every folder, permission, and answer may matter in a claim two years later.
When Should You Open the Data Room?
Most processes open the room in two phases. Here is a typical sell-side timeline from first contact to close:
| Stage | What happens in the data room | Who acts |
|---|---|---|
| Teaser and NDA | No access yet. The team builds the index and uploads core documents | Seller, banker, counsel |
| First round | Phase 1 room opens with summary financials, CIM support and key contracts in summary form | Seller grants access to bidders who signed NDAs |
| Indications of interest | Seller narrows the field; access ends for dropped bidders | Banker |
| Letter of intent (LOI) and exclusivity | Phase 2 room opens with full confirmatory documents | Seller and chosen buyer |
| Confirmatory diligence | Buyer’s legal, financial, tax, IT and HR advisors review; Q&A runs daily | Buyer workstreams, seller experts |
| Signing | Disclosure schedules reference specific data room documents | Counsel on both sides |
| HSR filing and pre-closing | Clean team access for competitively sensitive data, if needed | Antitrust counsel |
| Closing | Room locks; both sides receive an archive | Seller, VDR provider |
Lower middle market deals often move from LOI to close in two to four months. Larger deals with regulatory review take longer. Plan the room for the longer case.
How Should You Structure a Data Room Index?
A clear index saves buyers hours and cuts repeat questions. Number every folder and keep the numbering fixed once bidders arrive.
Here is a standard index for a privately held company sale:
| Folder | Contents |
|---|---|
| 1. Corporate | Formation documents, bylaws or operating agreement, cap table, board and shareholder minutes, org chart |
| 2. Financial | Audited and monthly financials, budget, quality of earnings report, debt schedule, working capital detail |
| 3. Tax | Federal, state and foreign returns for three to five years, tax audits, transfer pricing, sales tax nexus |
| 4. Commercial | Top customer and supplier contracts, pricing, churn and pipeline data, market studies |
| 5. Legal and material contracts | Leases, loan agreements, change of control provisions, NDAs, partnership agreements |
| 6. Employees and HR | Org chart, compensation summary, benefit plans, key employment agreements, policies |
| 7. Intellectual property | Patents, trademarks, domain names, software licenses, open source inventory |
| 8. IT and cybersecurity | System map, security policies, penetration test results, incident history, SOC 2 report |
| 9. Real estate and operations | Property list, leases, facilities, insurance policies, equipment |
| 10. Regulatory and compliance | Licenses, permits, regulatory correspondence, privacy policies, anti-corruption policies |
| 11. Litigation | Pending and threatened claims, settlements, legal opinions |
| 12. ESG and environmental | Environmental reports, permits, sustainability data |
Two rules keep the index useful:
- Mirror the buyer’s request list. Most buyers send a due diligence request list early. Map each request to a folder number so buyers can find answers without asking.
- Name files consistently. Use a format such as “2.3_Monthly_Financials_2025.pdf”. The number ties the file to its folder forever.
Sell-Side Checklist: How Do You Prepare the Data Room?
Use this checklist when your company or your portfolio company goes to market.
Before launch
- ☐ Choose a VDR provider and confirm pricing by page, by user or flat fee.
- ☐ Appoint one data room owner who controls uploads, permissions and Q&A.
- ☐ Build the folder index and share it with counsel and the banker for review.
- ☐ Collect documents from finance, legal, HR, IT and operations.
- ☐ Remove duplicates and outdated drafts.
- ☐ Redact personal data, such as employee Social Security numbers and salary details, where the phase calls for it.
- ☐ Decide which folders stay closed until Phase 2.
- ☐ Turn on watermarks, view-only settings and download limits for sensitive folders, following the same data security rules you set for staff access.
- ☐ Test the room with an internal “dry run” user.
During the process
- ☐ Create one user group per bidder, so no bidder sees another’s activity.
- ☐ Review the activity report each day. Heavy activity in the customer contracts folder tells you what a bidder cares about.
- ☐ Answer Q&A within an agreed time, often 24 to 48 hours.
- ☐ Log every new upload with a date, so buyers see what changed.
- ☐ Remove access the same day a bidder drops out.
Example: a $40 million software company sale
A founder-owned software company with $40 million in revenue runs a sale with five bidders. The data room owner sets up five bidder groups, each with Phase 1 access. After first-round bids, three bidders drop out. The owner removes their access that afternoon and opens Phase 2 folders for the two finalists only.
Buy-Side Checklist: How Do You Run a Review in the Data Room?
Buyers need the same discipline. Private equity deal teams often run six or more workstreams at once.
- ☐ Send a tailored due diligence request list before or at LOI.
- ☐ Map each workstream to folders: financial, legal, tax, commercial, IT and cyber, HR, environmental.
- ☐ Give each outside advisor, such as the quality of earnings provider and deal counsel, their own login.
- ☐ Give the RWI underwriter access to the materials it needs before the underwriting call. Aon’s 2026 claims study shows why: financial statement breaches drove 38% of R&W losses.
- ☐ Keep a master tracker of open requests, owner, due date and status.
- ☐ Route all questions through the Q&A module. Keep side emails out of the process.
- ☐ Flag red flags the day you find them, with the folder and file number.
- ☐ Hold a weekly diligence call with all workstreams, with a short agenda and meeting prep sent ahead.
- ☐ Download or record the key documents your disclosure schedules will cite.
- ☐ Confirm the final archive before closing.
Example: a PE fund buying a healthcare services business
A middle market PE fund signs an LOI for a healthcare services business. The deal team gives its quality of earnings firm, deal counsel, IT diligence provider and RWI underwriter separate logins. An executive assistant on the deal team keeps the master tracker. By week four, the tracker shows 212 requests, with 19 still open, each with an owner and a due date. The partner sees the status in one page every Monday.
How Should You Set Data Room Permissions, Redaction and Clean Teams?
Permissions protect the seller. They also protect the buyer from antitrust trouble.
Permission tiers
| Tier | Typical access | Controls |
|---|---|---|
| Seller admins | Full access and settings | Two-factor authentication |
| Advisors to seller | Folders by workstream | Watermark, audit log |
| Bidder groups | Phase-based folders | View-only, no print, watermark |
| Clean team | Competitively sensitive data only | Named individuals, separate folder, strict NDA |
Redaction
Redact before upload. Common redactions include employee personal data, customer names in early phases, and unit pricing for competitors. Many VDRs now offer AI redaction tools. Check every AI redaction by hand before you publish the file.
Clean teams
When buyer and seller compete, sharing current pricing, customer-level margins or strategic plans before closing can raise “gun-jumping” risk under antitrust law. Counsel sets up a clean team of outside advisors or walled-off employees. Only that team sees the sensitive folder. The data room owner sets the folder permissions and keeps the access list, using the same NDA and access controls the firm applies to its own staff.
How Do You Run the Data Room Q&A Process?
The Q&A module keeps every question and answer on the record. A clean process follows five steps:
- Submit: Buyers submit questions in the module, tagged by workstream and folder.
- Route: The data room owner assigns each question to an expert, such as the CFO for revenue questions.
- Draft: The expert drafts an answer.
- Approve: Counsel or the banker approves answers on sensitive topics.
- Publish: The owner publishes the answer and links any new document.
Set a limit on questions per bidder per day in early rounds—track average response time. Slow answers stall deals and annoy bidders.
How Does the New HSR Form Affect Your Data Room?
The FTC’s new Hart-Scott-Rodino (HSR) form took effect on February 10, 2025. It expanded what deal teams must collect for premerger filings. Key changes include:
- Drafts shared with directors: Filers must now submit certain draft documents about competition and markets if a board member received them.
- Supervisory deal team leads: Filers must identify the person who leads the strategic assessment of the deal and collect relevant documents prepared by or for that person.
- Ordinary-course plans: For overlapping products, filers must produce certain plans and reports from the past year shared with the CEO or board.
The FTC estimated the new form adds 68 to 121 hours of preparation on average. Some law firms called that estimate low.
The data room helps here. Keep deal analysis documents in a dedicated, access-logged folder—track which versions went to which directors. Antitrust counsel can then pull responsive documents fast, with a clear record of who received what.
What Happens to the Data Room at Closing?
Closing locks the room. Use this closing checklist:
- ☐ Freeze uploads and Q&A at signing or a date counsel sets.
- ☐ Confirm the disclosure schedules reference exact file numbers.
- ☐ Order the archive from the VDR provider, usually on an encrypted drive or secure download.
- ☐ Give a copy to the seller, the buyer and each side’s counsel.
- ☐ Store the archive for at least the survival period of the representations, plus any RWI policy period.
- ☐ Close all user accounts, including advisors.
- ☐ Keep the audit log with the archive.
Remember the Aon finding: about half of R&W claims arrive more than a year after closing. The archive becomes your best evidence.
Who Should Run the Data Room?
Every data room needs one owner. Deal teams often assign the role to a junior associate. That pulls an expensive investment professional into uploads, permissions and Q&A routing for weeks.
Many funds and sellers now give the logistics to an executive assistant who works under the deal lead. The EA manages uploads, naming, bidder groups, access removals, Q&A routing and the request tracker. Partners and counsel keep every judgment call: what to disclose, what to redact and how to answer.
Here is the split of work in plain terms:
| Task | Owner |
|---|---|
| Index design and document collection | EA, with counsel review |
| Uploads, naming and version control | EA |
| Permissions and bidder groups | EA, approved by the deal lead |
| Redaction decisions | Counsel |
| Q&A routing and tracking | EA |
| Q&A answers | Experts, approved by counsel or banker |
| Archive and account closure | EA |
Data room work touches confidential and often material nonpublic information. If your firm registers with the SEC, check whether your EA counts as an access person under your code of ethics. Our guide on whether your EA is an access person covers the rules. For broader deal support, see what an executive assistant at a VC firm handles day to day.
What Are the Most Common Data Room Mistakes?
- No single owner: Three people upload files, and nobody controls versions.
- Index drift: Folder numbers change mid-process, and buyers lose their place.
- Side-channel answers: A banker answers a question by email, and the answer never reaches the record.
- Late access removal: A dropped bidder keeps access for a week.
- Unchecked AI redaction: An AI tool misses a customer name in a scanned contract.
- No archive plan: Nobody orders the archive, and the provider deletes the room after the contract ends.
- Missing audit trail: The team exports documents to a shared drive and loses the access log.
Frequently Asked Questions
What should be in a virtual data room checklist?
A virtual data room checklist covers platform selection, a numbered folder index, document collection and redaction, permissions by bidder group, the Q&A process, activity monitoring, and the closing archive.
How long does a data room stay open?
A data room usually stays open from the first-round NDAs through closing. That often runs two to six months, and longer for deals with regulatory review.
What documents go in a due diligence data room?
Most data rooms include corporate records, financial statements, tax returns, material contracts, employee and benefit documents, intellectual property records, IT and cybersecurity documents, real estate records, compliance documents and litigation files.
Who manages the virtual data room?
The sell-side team owns the data room, usually through one appointed owner. Many teams give the day-to-day logistics to an executive assistant or deal coordinator, while counsel and the deal lead make disclosure decisions.
What happens to the data room after closing?
The VDR provider locks the room and delivers an archive to both sides. Keep the archive and audit log for at least the survival period of the representations and the RWI policy period.
Get an EA Who Manages Your Data Room
Deals in 2026 move with more money, more scrutiny, and longer tails. A well-run data room speeds diligence, protects both sides, and holds up in a claim.
Exec Assistants recruits experienced remote executive assistants from the Philippines and South Africa. You hire your EA directly, with your NDA and access rules in the agreement. See how to hire an EA who manages your data room, or book a free consultation.