NDA and Confidentiality in a Company Sale: What Secrecy Protects

A non-disclosure agreement (NDA) — in German a Geheimhaltungs- or Vertraulichkeitsvereinbarung — is the contract by which a prospective buyer undertakes to treat the information received during a sale process as confidential and to use it solely to assess the acquisition. It is the first document to be signed, before the seller discloses any names, figures or internal detail.

For owners running an actual process, our approach to selling your company sets out how the mandate works.

A company sale lives on discretion. If word gets out too early, it unsettles employees, customers and suppliers — and weakens the seller in negotiation. The NDA is the contractual basis for keeping information away from the places where it does damage.

But it is only the basis. Confidentiality is not created by a signature. It is created by the way the process is run.

What does an NDA protect in law, and what does the statute require?

An NDA creates a contractual duty of confidentiality; whether the information is also protected by statute as a trade secret depends, under section 2 no. 1 of the German Trade Secrets Act (GeschGehG), on the holder having taken reasonable secrecy measures. The Act names three features: the information is not generally known or readily accessible and therefore has commercial value, it is subject to reasonable secrecy measures, and there is a legitimate interest in keeping it secret (section 2 no. 1 lit. a to c GeschGehG). In Austria, section 26b(1) of the Unfair Competition Act (UWG) has the same structure: the information must be secret, have commercial value because it is secret, and be subject to reasonable secrecy measures.

The practical consequence for the seller: sending figures out unprotected weakens not only the contractual but also the statutory position. The NDA, staged release and a controlled data room are therefore not just courtesy towards the buyer; they are the measures by which a court would later judge reasonableness. In the event of a breach the holder can claim removal and, where there is a risk of repetition, an injunction (section 6 GeschGehG), and damages where the infringer is at fault (section 10(1) GeschGehG).

Sources: Gesetze im Internet (GeschGehG), RIS (UWG), each retrieved on 8 October 2026.

What an NDA governs

A robust confidentiality agreement covers several points that together make up the protection.

Element	What it covers
Parties	who is bound to confidentiality — including advisers and affiliated companies
Scope	which information counts as confidential (as a rule, everything shared in the process)
Purpose limitation	use solely to assess the acquisition, not for the recipient own ends
Term	how long the obligation lasts, usually several years beyond the end of the process
Return or deletion	handing back or destroying documents if no sale comes about
Non-solicitation	an undertaking not to poach employees or customers
Legal consequences	what applies in the event of a breach, for example a contractual penalty

The precise drafting — in particular the contractual penalty and the liability regime — belongs in the hands of a lawyer. This article places the elements in context; it does not replace legal advice.

How does a contractual penalty work in an NDA?

Under German law a contractual penalty is forfeited as soon as the obligor breaches the agreed duty to refrain from something (section 339 sentence 2 BGB). The statute also knows two correctives. If a forfeited penalty is disproportionately high, the court can reduce it to a reasonable amount on the obligor's application (section 343(1) BGB). That right falls away where the penalty was promised by a merchant in the course of its commercial business (section 348 HGB).

Both points argue against lump sums copied from a template. Whether a fixed amount, a range set at reasonable discretion or no penalty at all is the right route is for the lawyer to decide, based on the parties and the sensitivity of the information. Sources: sections 339 and 343 BGB, section 348 HGB (Gesetze im Internet, retrieved on 8 October 2026).

In practice, all of this begins with a company valuation.

Why confidentiality protects value

A company is a web of trust. If key people learn of a planned sale before it is certain, some of them start looking elsewhere. If major customers hear of it, they review their alternatives. If competitors hear of it, they exploit the uncertainty.

Each of these effects hits the value of the business at exactly the moment it is most vulnerable — in the middle of the process. Discretion therefore does not sit alongside the sale; it is part of the sale strategy. Why the seller side in particular depends on independence is set out in sell-side M&A.

Does confidentiality apply before signature?

In part. Entering into contract negotiations already creates, under section 311(2) no. 1 BGB, an obligation with duties under section 241(2) BGB, that is, a duty to have regard for the other party's rights, legal interests and concerns. The same applies where one party grants the other the possibility of affecting its interests or entrusts them to it in advance (section 311(2) no. 2 BGB). This does not replace the NDA: scope, term and consequences are not regulated, and in a dispute proof would be the main difficulty. The first contact therefore stays anonymous, and concrete information flows only after signature.

What does this look like in a typical sale process?

A constructed example, not a real mandate: an owner-managed business with around 80 employees is placed carefully on the market. The anonymous short profile goes to a small number of vetted parties. Those who remain interested sign an NDA that also binds their advisers and financing partners. The information memorandum follows without customer names; customer lists and contracts are held back until due diligence and can be viewed only in the data room, with a log of who opened what. If no sale comes about, documents are returned or deleted and this is confirmed in writing.

The sequence shows that each stage has its own protection and that the NDA is only one of them. How the approach is set up overall is described under selling your company; where succession is the reason for the sale, business succession in Germany gives an overview. If you want a rough sense of scale before the first approach, the company value calculator offers one; it does not replace a valuation.

An NDA is necessary but not sufficient

A common mistake is to rely on the signature and then disclose everything. The real protection lies in releasing information in stages.

At the outset there is an anonymous short profile with no company name. Only after the NDA does the information memorandum follow, with the figures that actually say something. Sensitive detail — customer lists, contracts, costings — comes later still, during due diligence, often in a controlled data room. That way each interested party only ever sees as much as the stage of the process justifies.

The limits of an NDA

An NDA deters, and it gives you a legal handle — but it is not absolute protection. In practice a breach is hard to prove, and the damage caused by lost confidentiality can barely be quantified in money. Anyone suing after a breach has already suffered the harm.

The most effective protection is therefore the question of whom you approach in the first place. A small number of carefully vetted parties rather than a broad mailing; staged release rather than early openness. That is precisely where an experienced adviser earns their keep — what they actually do is set out in M&A adviser. How it all fits into the wider process is described in the process of a company sale.

FAQ

What is an NDA in a company sale?

A confidentiality or non-disclosure agreement by which a prospective buyer undertakes to keep the information received secret and to use it only to assess the acquisition. It is the first document signed in the process.

When is the NDA signed?

Before the seller discloses any detail. After the first anonymous contact and before the information memorandum with the meaningful figures is handed over.

What belongs in an NDA?

The parties, the scope of the confidential information, purpose limitation, the term, rules on return or deletion, frequently a non-solicitation undertaking, and the consequences of a breach.

How long does a confidentiality agreement last?

Usually several years beyond the end of the process. The exact term is agreed contractually and depends on how long the information remains sensitive.

Is the statutory duty enough if no NDA has been signed?

Only to a limited extent. The statute protects trade secrets under section 2 no. 1 GeschGehG only if the holder has taken reasonable secrecy measures, and the pre-contractual duties of consideration under sections 311(2) and 241(2) BGB do not determine scope or term. An NDA closes that gap.

Can an excessive contractual penalty be reduced?

In principle yes, under section 343 BGB on the obligor's application. For a penalty promised by a merchant in the course of its commercial business, that reduction is excluded by section 348 HGB.

Does an NDA really protect against a breach of confidentiality?

Only up to a point. It creates a legal handle and it deters, but a breach is hard to prove and the damage hard to quantify. The better protection is a narrow, carefully selected approach and a staged release of information.

Who else should be covered by the agreement?

Not just the prospective buyer as a legal entity, but the people and firms around them — advisers, financing partners and affiliated companies. Otherwise information can travel legitimately to parties who were never bound in the first place.

NDA, teaser, long list: the vocabulary of the approach phase is set out in the IGCP M&A glossary.

A company sale is the most important transaction of an entrepreneurial life. Take independent, discreet advice — IGCP Capital Partners. → igcp.at