Staff finding out from a rumour, a key customer hearing it from a competitor, a landlord reacting before the deal is even signed — these are the failure modes a confidentiality strategy is actually built to prevent, and none of them are solved by a signature on an NDA alone.
Key takeaways
Treadstonelaw.ca’s description of a confidential information memorandum lays out the sequencing plainly, across three phases. In the first, initial marketing stage, a prospective buyer sees only “industry, general size, broad opportunity — no company name.” After a confidentiality agreement is signed, the second phase releases a “detailed business description and summarized financials — still curated.” Only after a letter of intent, in the third phase, does the buyer see “complete financial records, contracts, and other underlying documents.” Deliberately withheld from the earlier stages: “unredacted customer lists or exact customer identities” and “highly sensitive trade secrets or proprietary processes,” both held back until formal due diligence begins post-LOI.
Treadstonelaw.ca’s NDA guidance for a business sale is explicit that the confidentiality agreement itself is only part of the protection: “split your information into stage one, stage two, and after-signing only” — and, plainly, “do not hand over the crown jewels to a stranger.” The NDA governs what a recipient may do with information once they have it; it does nothing to reduce how much damage a specific piece of information could do if the deal falls apart and the recipient turns out not to have acted in good faith. Staging exists precisely because those are two different risks, and a signature only manages one of them.
The same source is more emphatic where the buyer competes directly: “if the buyer competes with you, an NDA alone is not enough. Stage the disclosure.” Its specific recommendation — “aggregate or redact pricing, margins by account and customer names in the first round, and release the raw data to a small clean team only once the purchase agreement is signed or the deal is genuinely conditional” — is a materially more cautious version of the ordinary three-phase CIM model, and it exists because a competitor who walks away from a failed deal keeps the industry knowledge either way, NDA or not. See building a buyer list that includes strategic acquirers for the separate, criminal-law risk this same scenario can carry.
Staging also has a practical, unglamorous side that is easy to skip once the legal documents are signed: knowing exactly who has seen what, and being able to prove it if a dispute arises later. A data room with individual, logged access rather than a shared folder or a single emailed attachment lets a seller see which documents a specific buyer actually opened, and revoke access cleanly if that buyer drops out of the process. That distinction matters more than it sounds — if information later surfaces somewhere it shouldn’t, being able to show precisely which stage a specific recipient had reached, and when, is often the difference between a provable breach and an unresolvable dispute about who knew what.
Ontario has no private-sector privacy statute of its own, so “the federal Personal Information Protection and Electronic Documents Act applies” to any personal information — employee records, customer contact details — that changes hands during due diligence. PIPEDA, per the same source, “permits sharing personal information that is necessary to decide whether to proceed with a business transaction, provided there is an agreement limiting use, requiring security and requiring return or destruction if the deal dies.” That last condition is easy to omit from a standard-form NDA and expensive to have missed: without it, there is no contractual mechanism forcing a failed buyer to actually delete what they were shown.
The three phases, at a glance
The leaks that do real damage rarely come from the buyer reading the CIM — they come from process mechanics nobody staged as carefully: a site visit scheduled during business hours where staff notice unfamiliar visitors reviewing financial records; a reference call to a customer that reveals more than it means to; a lawyer or accountant on either side mentioning the deal to a colleague who happens to know the seller’s industry. The staged-disclosure discipline in the CIM protects the documents. Protecting everything around the documents — who visits, who is told, and when — is a separate, ongoing discipline that runs for as long as the process does. See managing multiple interested parties at once for how that discipline gets harder, not easier, once more than one buyer is active.
There is no single right answer, but the staged-disclosure logic that governs buyers applies here too: the closer the deal is to certain, the more staff need to know to manage the transition well, and the earlier that information travels, the more time it has to leak or to unsettle people over a deal that might not close. Most sellers tell only a small, essential internal circle until a definitive agreement is signed.
Rarely, and only to a narrow, walled-off team. Treadstonelaw.ca’s guidance ties full raw-data access for a competitor buyer specifically to the point where “the purchase agreement is signed or the deal is genuinely conditional” — later than the ordinary post-LOI release point for a non-competing buyer.
Under PIPEDA, a properly drafted NDA should require the recipient to return or destroy personal information if the transaction does not proceed. The same obligation should be extended contractually to commercially sensitive information generally, since PIPEDA’s own scope is limited to personal information, not trade secrets or financial data.
It adds structure rather than delay in most cases — a buyer who is seriously proceeding rarely needs Phase 3 detail during Phase 1 conversations, and a buyer who does insist on seeing everything immediately, before any confidentiality agreement or LOI is in place, is itself a signal worth taking seriously about how that buyer will treat the rest of the process.
A short call can confirm your confidentiality documents actually match the pace at which you intend to disclose.
Nobody publishes Canadian transaction data, so every valuation in this country quotes an American benchmark. We are building the Canadian one — multiples, asking-to-sale spreads and days on market, by sector and by city. Leave an email and you will see it first.
No pitch, no listings. One email when the first report lands.
