Organising Your Sale Data Room: the Folder Structure that Reassures Buyers
A typical sale data room structure (legal, accounting, tax, HR, commercial, real estate, IT) to streamline due diligence, plus best practices on access rights, traceability and GDPR compliance.
This topic is part of our service
Business valuation in Paris | SME, dispute & transactionsExpert note: This article was written by our chartered accountancy firm. Information is current as of 2026. For a personalised review of your situation, contact us.
Quick answer. The data room is the secure digital space where the seller makes the documents needed for due diligence available to the buyer. A clear structure — legal, accounting and tax, HR, commercial, real estate, IT — speeds up the audit, limits repeated questions and builds trust. Well prepared, it shortens the time between the letter of intent and signing, and reduces the risk of a price adjustment.
What is a sale data room and what is it for?#
The data room (or virtual data room) is a restricted-access online space in which the seller deposits, in an orderly way, the documents the buyer and their advisers will examine during due diligence. It replaces the messy exchange of emails and files, a source of omissions and leaks.
Its purpose is twofold: to let the buyer verify the reality of what they are buying, and to show the seller that the company is run with rigour. An incomplete or poorly sorted data room sends a negative signal and fuels suspicion; a well-kept one smooths the deal. It follows on from the sale-preparation workstreams and usually opens after the letter of intent is signed, once exclusivity and confidentiality are agreed.
The logic is close to that of a fundraising data room, but the angle differs: in a sale, the buyer seeks to validate a price and gauge representation-and-warranty risks, not to bet on future growth.
The model folder structure of a sale data room#
An effective structure reads like a table of contents. We recommend seven top-level folders, numbered to stay ordered.
| Folder | Main content |
|---|---|
| 1. Company and legal | Up-to-date bylaws, registration extract, share transfer register, minutes, shareholder agreements, delegations of authority |
| 2. Accounting and tax | Last three financial statements, trial balances, accounting entries file, VAT and corporate tax returns, tax position, any audits |
| 3. HR and social | Employment contracts, org chart, collective agreements, payroll filings, staff register, works council minutes, equality index |
| 4. Commercial | Main customer and supplier contracts, terms, order book, revenue concentration |
| 5. Real estate and assets | Leases, title deeds, fixed-asset schedule, finance-lease contracts |
| 6. Financial and funding | Debt schedule, loan timetables, guarantees given, cash position |
| 7. IT and intellectual property | Trademarks and domain names, software licences, IT contracts, data-processing register |
Each folder breaks down into dated sub-folders. The golden rule: one document, one logical place, one explicit file name (for example "2-3_tax-return-2025"). A summary index at the top of the data room, listing each item and its status, saves the buyer considerable time.
How to prepare the data room, step by step#
- List the expected items from a due diligence checklist, building on the diagnostics done upstream.
- Collect and date each document, favouring final, signed versions.
- Sort according to the seven-folder structure, naming files consistently.
- Anonymise or pseudonymise non-essential personal data (see the compliance section).
- Write an index and a summary note explaining the sensitive points rather than hiding them.
- Set access rights by profile (buyer, lawyer, banker) and turn on consultation logging.
- Keep the data room up to date throughout the negotiation, time-stamping additions.
Traceability, access rights and GDPR compliance#
A serious data room logs who consults what and when. This traceability protects the seller: in a post-sale dispute over a warranty, it proves that information was indeed disclosed. It also shapes the scope of the duty of information: an item deposited and consulted cannot be claimed as concealed.
The data-protection aspect is too often neglected. A data room contains personal data (employees, customers, directors). France's data authority recalls that, in a sale, sharing such data must be limited to what is necessary and proportionate to the negotiation stage: before signing, aggregated or pseudonymised data is preferred, with detailed named data opened only at the final stage to authorised people. The processing register and sub-processing contracts are, moreover, among the items the buyer will examine.
How long does it take to prepare a data room?#
For an SME deal, preparing a complete data room usually takes four to eight weeks, depending on how the documents were initially organised and how complex the business is. This time shrinks sharply when the accounts are kept with rigour and contracts are already archived: it is one of the indirect benefits of preparing the sale upstream.
Preparation is a team effort. The owner centralises the operational and commercial items; the accountant gathers and makes reliable the accounting and tax side (financial statements, returns, the accounting entries file); the lawyer structures the legal file (bylaws, contracts, intellectual property). One person must, however, remain responsible for overall consistency and the index, to avoid duplicates and outdated versions.
Shared space, dedicated tool or physical data room#
| Solution | Advantages | Limits |
|---|---|---|
| Secure shared space | Low cost, quick to set up | Limited traceability and rights |
| Dedicated data room tool | Fine logging, rights by profile, watermarking | Subscription cost |
| Physical data room | Full control, no digital leak | Cumbersome, poorly suited to remote audit |
For a significant deal, the dedicated tool is the standard: it logs every consultation, manages rights by profile and watermarks the most sensitive documents. For a small sale, a secure shared space, backed by manual access tracking, can suffice, provided the structure is respected and a record of exchanges is kept.
Special cases#
Micro-business and sole proprietorship. The data room can stay light, but the seven-folder structure keeps its value: it organises thinking and avoids omissions. A simple secure shared space is often enough.
Company with operating real estate. The real-estate folder becomes central: leases, technical surveys and clarity on who owns the walls (the company or separately) weigh on scope and price.
Regulated or sensitive activity. Some items (trade secrets, detailed customer files) open only at the end, in a "clean room" reserved for a small circle, to limit competitive risk if the sale fails.
2026 watch points#
- Do not dump everything at once or hide everything. An empty data room worries; one drowned in clutter exhausts. Aim for the useful, dated, legible item.
- Anticipate questions rather than suffer them. A summary note on sensitive points (ongoing litigation, customer dependence) beats a chance discovery by the buyer.
- Secure access. Individual passwords, expiry of rights, no download for the most sensitive items.
- Keep a time-stamped copy of the data room at closing: it is valuable evidence if the representations and warranties are triggered.
Our expert perspective#
Recently, an owner entrusted us with a sale whose first attempt had failed: the buyer, tired of chasing scattered documents and discovering inconsistencies along the way, had walked away. We took over the file and built a structured data room, with an index and a summary note owning two sensitive points. The second negotiation took half as long, and the buyer asked for no price reduction on the topics documented in advance.
The lesson is simple: the data room is not an administrative formality but a negotiation tool. Accounting rigour and transparency show, and they pay off. Our role as chartered accountant, alongside the lawyer, is to make the data room's accounting and tax content reliable and to present the figures in a way that due diligence cannot weaken.
A final word: do not confuse exhaustiveness with transparency. Dumping a thousand raw documents does not enlighten the buyer; selecting the useful items, dating them and commenting on them does. A data room is judged by how quickly a third party finds what they are looking for, not by its volume. We often support clients from the initial sorting, because the effort made upstream pays off twice: it speeds up due diligence and, along the way, reveals the points to fix before a buyer even discovers them. A missing item, an unsigned contract, a late filing: all signals better handled internally, calmly, than under negotiation pressure. The data room is not only the company's showcase; it is also a revealer, and it deserves care on both counts.
Hayot Expertise advice. Build your data room before you even receive an offer, from the preparation stage. You will gain peace of mind the day a buyer appears, and you will run the negotiation from strength. We can frame the structure, make the accounting and tax items reliable, and prepare the summary note.
Frequently asked questions
What is a sale data room?+
It is the secure digital space in which the seller makes the documents needed for due diligence available to the buyer: legal, accounting, tax, HR and commercial items. It structures the audit and logs consultations.
Which documents go into a data room?+
Bylaws and registers, the last three financial statements, trial balances and the accounting entries file, tax returns, employment contracts and payroll filings, main customer and supplier contracts, leases, the debt schedule, trademarks and licences. Everything that lets the buyer verify the reality of the business.
When should the data room open to the buyer?+
Usually after the letter of intent is signed, once exclusivity and confidentiality are agreed. The most sensitive items open only at the end, to a small circle.
How should personal data be handled in a data room?+
By limiting named data to the strict minimum and pseudonymising it before the final stage, in line with the data authority's guidance. Detailed data opens only to authorised people at the very last stage.
Do I need a paid data room tool?+
For an SME, a dedicated tool provides traceability and fine access management. For a micro-business, a secure shared space can suffice, provided the structure is respected and access is logged.
Key takeaways#
- The secure data room structures due diligence and logs consultations.
- The model structure fits into seven numbered folders, from legal to IT.
- An index and a summary note on sensitive points speed up the audit.
- GDPR compliance requires limiting and pseudonymising personal data before the final stage.
- A time-stamped copy at closing protects the seller if warranties are triggered.
Official sources#

Article written by Samuel HAYOT
Chartered Accountant, registered with the Institute of Chartered Accountants.
Regulated French accounting and audit firm based in Paris 8, built to support companies across France with a digital and decision-oriented approach.
Sources
Official and operational sources cited for this page.
- Bpifrance Création — Préparer la due diligence et la transmission
- CNIL — Données personnelles et opérations de fusion-acquisition
- Entreprendre.Service-Public — Vendre ou transmettre une entreprise
- BOFiP — Fichier des écritures comptables (FEC) et contrôle
- Conseil national de l’Ordre des experts-comptables — Mission d’accompagnement à la transmission
This topic is part of our service Business valuation in Paris | SME, dispute & transactions
Need a quote or personalised advice?
Our accountancy firm supports you through all your steps. Get a free quote to review your situation and receive a bespoke fee proposal, or contact us directly.