Data rooms and disclosure obligations in company sales

When a reference to the data room is sufficient – and when it is not: Guidelines from case law

Executive Summary

• A virtual data room can fulfill disclosure obligations – but only if the seller can legitimately expect that the buyer will also recognize the disclosure requirement there.

• For information of considerable importance (“dealbreaker”), simply posting it is often not enough: In such cases, a separate, active notification is regularly required.

• Time pressure before the signing/notary appointment does not generally relieve the buyer of responsibility – however, the seller may be obliged to explicitly point out any subsequent uploads.

I. The data room as a central instrument of the M&A transaction

Anyone selling a company must inform the buyer about essential circumstances. In transaction practice, this information transfer now predominantly takes place via a virtual data room (VDR). But is it sufficient to provide thousands of documents – or must the seller specifically draw attention to particularly critical points? Two rulings – by the Higher Regional Court of Munich (NZG 2021, 423) and the Federal Court of Justice (NJW 2023, 3423) – demonstrate that the answer is nuanced and the consequences are significant.

1. Setting up and organizing a virtual data room

A well-structured data room is organized thematically (e.g., corporate law, contracts, finance, taxes, employees, intellectual property, real estate, litigation) and typically follows an Information Request List (IRL) provided by the buyer or their advisors. It is crucial that documents are accurately named, systematically organized, and fully accessible. A table of contents, search function, and versioning facilitate navigation. Data room rules define, among other things, access rights, confidentiality, and, where applicable, disclaimers of liability.

2. Redactions and sensitive information

Not all information can be disclosed without reservation. Personal data, trade secrets, and information sensitive under antitrust law are often redacted or only disclosed at later stages. A careful balancing process is required: The seller must disclose enough to fulfill their duty of disclosure but may also protect legitimate confidentiality interests.

II. Seller's duty to disclose information – legal basis

According to established case law of the German Federal Court of Justice (BGH), there is no general obligation during contract negotiations to inform the other party about all details and circumstances that could influence their decision. In principle, each negotiating party is responsible for their own legally binding actions.

However, there is a duty to disclose information in the case of circumstances that could frustrate the purpose of the contract or cause significant economic damage to the other party – provided that the party disclosing the information must reasonably expect, in good faith, that the other party would not recognize the implications without being informed.

The key practical question is: Is it sufficient to upload relevant documents to the data room – or must the seller specifically point out critical issues to the buyer?

III. Duty of disclosure in company sales (Higher Regional Court of Munich)

The facts

The first plaintiff was a limited partner in F-KG, a limited partnership that operated a nightclub. He sold his limited partnership interest, along with the general partner GmbH, to the defendant. The notarized purchase agreement included a comprehensive exclusion of liability. Before the sale, the seller had claimed to the buyer that the company was back in the black. In reality, the nightclub had never generated a profit; the company was in financial crisis and later had to file for bankruptcy. Although business documents had been handed over, they were incomplete and did not reflect the true situation.

The decision (key points)

• Comprehensive duty of disclosure: The seller must proactively inform the buyer about all circumstances that are essential for the purchase decision – in particular regarding the economic situation, losses and signs of crisis.

• Incomplete documentation is not sufficient: The mere handover/provision of documents does not fulfill the obligation if they are incomplete or do not accurately reflect the situation.

• Active false statements give rise to liability: The untrue assertion of a 'profit zone' can be considered fraudulent misrepresentation and trigger claims arising from culpa in contrahendo (§§ 280, 311 para. 2 BGB) as well as avoidance under § 123 BGB.

• Disclaimer of liability does not apply: A contractual disclaimer of liability does not regularly cover breaches of the duty to disclose information; fraudulent intent cannot be effectively excluded in any case (§ 276 para. 3 BGB).

Practical lesson: Even a comprehensive disclaimer does not protect the seller from the consequences of active false statements or deliberate concealment of essential circumstances.

IV. Duty to disclose information and reference to the data room (Federal Court of Justice)

The facts

The plaintiff acquired several commercial units in a building complex, excluding any liability for defects. In the purchase agreement, the seller assured the plaintiff that no resolutions had been passed that would result in future special assessments – with the exception of a resolution concerning roof renovation (annual impact of €5,600). The seller granted access to a virtual data room. On Friday, three days before the notary appointment, she uploaded a collection of resolutions, maintained since 2007, to the data room. This collection included a protocol indicating that renovation measures with a cost of up to €50 million were under consideration and that a corresponding special assessment was to be levied. The plaintiff challenged the purchase agreement on the grounds of fraudulent misrepresentation and, alternatively, declared its withdrawal from the contract.

The guidelines of the Federal Court of Justice

• Principle: Access to a data room can provide clarification. The seller fulfills their duty of disclosure by posting documents if, based on the circumstances, they can reasonably expect the buyer to gain knowledge through inspection.

• Case-by-case assessment: Key factors include, among others, the scope/organization of the due diligence, the structure of the data room, agreements reached, the type of information, and the specific document.

• In cases of significant importance: a separate notification is required. If a circumstance is a dealbreaker and not readily apparent from the data, the buyer can generally expect to be actively notified.

• Time constraints: Time pressure does not fundamentally eliminate expectations; the buyer may need to extend deadlines or reschedule the appointment. However, the seller must point out any subsequently submitted documents.

• Duty of inquiry: Deficiencies in due diligence on the part of the buyer have an effect only through contributory negligence, not as a 'free pass' for the seller.

Key takeaway : Simply referring to the data room is insufficient if the seller knows that it contains crucial information that the buyer cannot readily identify. In such cases, active 'flagging' is necessary.

V. Checklists for sellers and buyers

For sellers

• Active education instead of passive provision: Explicitly point out significant risks (e.g., existential litigation, impending special levies, sustained losses/signs of crisis).

• Manage the data room cleanly: clear naming, logical structure, index, search function; chaotic structures typically work to the seller's disadvantage.

• Document information in various ways: written communications, management presentations, Q&A logs, index notes, or disclosure letters.

• No false statements: Any active inaccuracy can trigger liability – regardless of disclaimers.

  
  

For buyers

• Due diligence should be thorough and transparent: systematic review, task allocation, and documentation of findings.

• Time management: react consistently to late uploads (extension of deadlines/postponement of dates) and ask follow-up questions.

• Contractual safeguards: specific warranties (R&W), indemnities and disclosure mechanisms supplement the statutory disclosure.

VII. Conclusion

Case law clearly shows that while a data room is indispensable, it does not absolve the seller of their duty to disclose information. Anyone who merely "hides" critical information in the data room without explicitly pointing it out risks claims for damages and legal challenges. Buyers, in turn, should carefully evaluate the data room, actively manage time pressure, and contractually mitigate risks.

FAQ

1) Is it sufficient to upload critical documents to the data room?

Not necessarily. Simply stating the risk may suffice if the seller can reasonably expect the buyer to be aware of it. However, for deal-breakers or risks that are not immediately apparent, an additional warning is generally required.

2) What is typical 'dealbreaker' information?

Information that could frustrate the purpose of the contract or cause significant economic damage, e.g., massive special assessments, impending insolvency, existential legal or compliance risks.

3) Must the seller point out subsequent uploads?

Regularly, yes – especially for essential documents. The buyer should be able to see that new material has been added for review.

4) Does time pressure before the appointment relieve the buyer?

Generally not. The buyer must extend deadlines or postpone dates if necessary.

5) What role does a disclaimer play?

Disclaimers of liability generally do not protect against breaches of disclosure obligations or fraudulent intent. Furthermore, such clauses are often interpreted narrowly.

6) What is the best way to document clues?

In writing and specifically: Email/Q&A log with document reference (folder, file name, version), disclosure letter or documented management presentation.

7) What should the buyer do in case of 'red flags'?

Ask specific questions, obtain written confirmations, request special guarantees/releases if necessary, and adjust the schedule.

8) Does this also apply outside of classic M&A?

Yes. The guidelines are also relevant in real estate-related transactions or other situations involving information asymmetries.