A data room is where a buyer and their advisers review the records behind your business. Done well, it speeds up due diligence and builds trust. Done badly, it delays the sale — or discloses information that should never have left your systems.
This article is general information, not legal or privacy advice. Speak with your lawyer about your obligations before sharing any records.
Privacy comes first
An NDIS business holds sensitive personal information about participants and workers. The Office of the Australian Information Commissioner's guidance on selling a business indicates that de-identified or aggregated information should generally be used during due diligence, and that privacy obligations continue to apply. A confidentiality agreement with a buyer does not by itself authorise disclosing personal information, and a restricted data room is not blanket permission to upload everything.
Stage-gated disclosure
Organise Your Records First
Use our free seller preparation checklist — printable, with a spreadsheet version.
Release information in stages, as buyer commitment increases:
| Stage | What to release | Format |
|---|---|---|
| 1. Initial interest (after confidentiality agreement) | Summary financials, service mix, registration groups, locations | Summary tables |
| 2. Indicative offer | Detailed profit and loss, normalisation schedule, aggregated revenue distribution, staffing structure | Aggregated, no names |
| 3. Due diligence | Contracts, leases, policies, audit reports, insurance, de-identified incident and complaint summaries | Redacted where needed |
| 4. Pre-completion | Transition plans, key-staff arrangements, anything else agreed with advisers | As advised by your lawyer |
Suggested folder structure
- Corporate — entity details, ABN, structure chart, constitution or trust deed
- Finance — financial statements, BAS summaries, normalisation schedule with evidence references (see normalised EBITDA and add-backs)
- Registration and compliance — certificate of registration, registration groups, audit outcomes, corrective action status
- Workforce — anonymised staff list by role, tenure and employment type; screening process summary; training matrix
- Participants (aggregated) — revenue by service type and funding type, anonymised distribution bands; see concentration risk
- Property and contracts — leases, supplier and software agreements, assignment or change-of-control clauses
- Policies — quality, incident, complaints, privacy and risk management documents
Source and reviewer for each document
Record where each document came from and who checked it before upload. This helps you answer questions quickly and shows the buyer the information is reliable.
| Document | Source | Reviewed by |
|---|---|---|
| Normalisation schedule | Accountant | Accountant and owner |
| Aggregated revenue distribution | Claiming or practice system export | Owner; checked for re-identification risk |
| Audit report | Approved quality auditor | Owner or compliance lead |
| Leases and contracts | Originals on file | Lawyer |
Registration and ownership changes
A buyer will want to understand how registration will work after the sale. The NDIS Commission explains that registration is linked to an ABN and cannot be transferred to a different ABN, and that owners must notify the Commission of a change of ownership as soon as possible — see buying or selling a registered NDIS business. Put your registration documents in the data room and let your advisers explain how they apply to the proposed structure.
Common data room mistakes
- Uploading full participant files or unredacted incident reports "to save time"
- Releasing everything at once, before a buyer has shown serious intent
- Financial figures in the data room that do not reconcile to lodged BAS or statements
- Out-of-date policies that do not reflect how the business actually operates
- No single person responsible for answering buyer questions, leading to inconsistent answers
Access control and the end of the process
- Give access to named individuals only, and review the list regularly
- Use view-only or watermarked files for sensitive material
- Keep an access log
- Agree in writing how documents are returned or deleted if the deal does not proceed
- Keep your own original records unchanged; upload copies only
For a printable version of these steps, use our free seller preparation checklist. You can also read our guide to preparing your NDIS business for sale, or see how we manage the process on our selling service page.
