∞Direct answer
Direct answer
Do not send one open folder to every investor. Start with a small room. Give each named person only the folders they need. Set an end date. Keep a record of access and key changes. Remove access when the need ends. Private data needs a clear use, less data, safe care, and a set end date. [4] Get advice on your deal and laws.
Set the room boundary first
A data room is a place for deal files. It is not one file set for every reader.
Make stages before you invite anyone. A first talk may need a deck, short facts note, and cap table. A later check may need signed deals or full accounts.
Write why each folder is open. Link the folder to a deal question. If you cannot name the question, leave the file out.
ICO says data must have a set use and be no more than needed. [4]
- First talk: deck, short plan, and key facts.
- Active review: proof files for named deal questions.
- Restricted review: files with a clear need and a smaller reader list.
- Hold back: source code, passwords, full customer lists, and records with no deal need.
Give access to people, not firms
Name each person who can enter. Do not use a shared investor login. Add their firm, role, folders, reason, start date, and end date.
Give the least access that can answer the question. A tax adviser may need an accounts folder. They may not need customer contacts.
ICO says only set people should see, change, share, or erase private data. Set a clear limit for each person. [1]
Ask your room firm about named accounts, sign-in checks, time-outs, download rules, and access logs. NIST sets rules for sign-in and account work. [3]
- Person and firm.
- Deal role and business reason.
- Folder list and access type.
- Start date, end date, and room owner.
Protect people in the files
Some deal files name real people. They may have staff pay, client names, ID data, bank data, or health facts.
Use a summary when it answers the deal question. Remove direct contact details or IDs when they do not help. Use a small folder for a key deal page when a broad note will do.
ICO says a share plan should name the data, use, readers, safe steps, keep time, and erase rules. [2]
An NDA is not a full data plan. It can set deal terms. It does not say what you may share or how long a party may keep it. Get legal help for your case.
- Use a summary before a full record.
- Redact unneeded contacts, IDs, and bank details.
- Mark sensitive folders and name their readers.
- Keep the unredacted source in the smallest group.
Review, close, and keep a record
Check the access list at set times. Check again if a deal stops, a person leaves, or a new guide joins.
Keep a simple log. Note who got in, what changed, why, and when it ended. Keep the log apart from the investor files.
ICO says to check and fix safe steps when needed. It also says share plans need keep, erase, review, and end steps. [1] [2]
Remove access when the review ends. Ask your adviser what records you need to keep. Do not say you will erase files if your tools or terms cannot do it.
- Review date and room owner.
- New, changed, and removed access.
- File change that affects a deal claim.
- End action and any record kept.
FAQ
Frequently asked questions
Should every investor get the full data room?
No. Start with files for the deal question. Give more only for a clear need. ICO says data must be no more than the use needs. [4]
Can we use one login for an investor team?
Avoid it. A named account makes it easy to check and end access. Ask your firm about account, sign-in, time-out, and log rules. NIST sets sign-in and account rules. [3]
Should we put customer data in the room?
Share only what a set question needs. A short note or a masked file may be enough. ICO says a plan should state data, use, readers, safe steps, keep time, and erase rules. [2]
What happens when an investor stops reviewing?
End access. Log the end date and file rules that still apply. Check what you and the other side may keep. ICO calls for keep, erase, review, and end steps. [2]
REF
Sources
- 1
Information Commissioner's Office
A guide to data security ↗ - 2
Information Commissioner's Office
Data sharing agreements ↗ - 3
National Institute of Standards and Technology
Digital Identity Guidelines (SP 800-63-4) ↗ - 4
Information Commissioner's Office
A guide to the data protection principles ↗