Redaction in a data room: what to black out before buyers see it

Picture the second round of a sale. Three bidders are in the room, and one of them is your largest competitor’s parent company. The customer contracts folder is the most requested section in the Q&A log. Every bidder needs to see that the contracts exist, how long they run and what the termination clauses say. Only the winner, near signing, needs to know that the biggest one is with a particular named retailer at a particular price.

Redaction is how you serve both needs with one set of documents.

Data room redaction is the permanent removal of specific words, figures or images from a document before it is shown to other parties, so that the rest of the document can be disclosed while the sensitive parts cannot be read, searched, copied or recovered.

What should you redact before buyers see it?

Six categories cover almost everything. The question for each is the same: does a bidder need this detail to value the business or assess a risk, or only to run it after closing?

Notice what is not on the list: totals, contract lengths, renewal dates, change-of-control clauses and liability caps. Those are the facts a buyer is paying to diligence. Redact them and you will get a Q&A question for every blank, which costs more time than the redaction saved.

What does a well-redacted document look like?

The art is in leaving enough. A redacted customer agreement should still tell a buyer how big the relationship is, how long it lasts and how easily it can end.

A practical test: hand the redacted page to a colleague who has never seen the original and ask what the contract is about. If they can answer “a three-year supply agreement worth about two million a year, terminable on change of control”, the redaction is working. If they cannot tell what kind of contract it is, you have redacted too much.

For customer identities specifically, replace names with consistent codes (“Customer A”, “Customer B”) rather than plain black bars. The same code across contracts, revenue reports and churn analyses lets bidders link the documents without learning who the customer is.

Is redaction the right tool, or is something else better?

Redaction is one of five ways to limit what a bidder sees. Choosing the wrong one creates either a leak or a pile of pointless work.

Most rooms combine them. A common pattern for a competitive auction: redacted customer contracts for all bidders in round two, the same contracts unredacted in a clean team folder, and a summary schedule of top-twenty customers by revenue band. Our due diligence checklist maps which document types usually get which treatment.

Native redaction or redacting before upload?

There are two ways to do the work, and they suit different rooms.

Native redaction means the data room software does it. You select text or areas inside the room, mark them, and the room serves the redacted version to the groups you choose. Good implementations keep the original for administrators and let you release an unredacted copy to a specific group later, which is exactly what staged disclosure needs. Some tools also search for patterns across many files, such as every instance of a customer’s name.

Pre-upload redaction means you redact the files in a PDF editor or with a dedicated redaction tool, then upload the redacted version. It works with any data room and keeps the unredacted original entirely off the platform until you choose to upload it.

In our data, 7 of the 18 rooms we score list built-in redaction: iDeals, Datasite, Intralinks, Firmex, Drooms, SmartRoom and Venue by DFIN. Several strong rooms, including Ellty and Ansarada, do not, so with those you redact before upload. That is a workflow difference rather than a security gap, but it matters if you expect to redact hundreds of documents on a tight timeline.

How do you redact documents so it holds?

1. Agree a redaction policy

   List the categories you will redact, the code names you will use, and who signs off. One page, agreed with counsel before anyone starts.

2. Work from clean copies

   Start from the final version of each document. Accept or reject tracked changes and remove comments before redacting, or they may survive in the file.

3. Redact with a real redaction tool

   Use the data room's built-in redaction or a PDF tool's redaction function, which deletes content. Never use drawing, highlighting or a black font.

4. Apply the redactions and sanitise

   Apply or burn in the redactions, then remove metadata, hidden layers and attachments. Save as a new file with a suffix that marks it as redacted.

5. Check every file

   Search each redacted file for a sample of redacted words and copy-paste a redacted area into a text editor. Have a second person spot-check a sample.

6. Upload and map to groups

   Upload redacted versions to the folders bidders see, keep unredacted versions in a restricted folder, and record which group sees which version.

Expect it to take longer than you think. A dense commercial contract can take ten or fifteen minutes to redact and check properly. Multiply by the number of contracts in your top customers folder before promising a date.

Does privacy law require redaction?

Often, yes, in effect. Under the GDPR, personal data must be “adequate, relevant and limited to what is necessary”, the data minimisation principle in Article 5(1)(c). A buyer usually needs an anonymised employee census with roles, salaries and start dates, not names and home addresses. Sending the names when the purpose does not require them is hard to justify.

The UK regulator’s guidance on anonymisation is a useful reference for judging whether a redacted dataset could still identify people. A spreadsheet with names removed but exact salaries, job titles and start dates in a team of five can still point to individuals.

If the target holds health information about US patients, the HIPAA Privacy Rule sets out specific methods for de-identifying it; the HHS de-identification guidance lists the identifiers to remove. In most deals the right answer is that patient-level data does not go into the room at all.

None of this is legal advice for your deal. It is the reason privacy counsel should sign off the redaction policy before the room opens.

When should redactions come off?

Redaction is not one decision; it is a schedule. A typical sale lifts it in three steps.

1. Round one. Little redaction needed, because little sensitive material is in the room. The information memorandum and high-level financials rarely name customers.
2. Round two. Most redaction happens here. Full contracts go in with identities and unit prices removed, and the employee census is anonymised.
3. Confirmatory stage. The preferred bidder, or its clean team, gets unredacted versions of what it genuinely needs to sign: key customer contracts, senior management terms, specific pricing.

Some material never comes off before closing. Individual salaries below senior management, health records and many trade secrets stay redacted or out of the room entirely, and the buyer receives them on day one as the new owner. Our guide to staged disclosure covers how to run the release in phases.

Which redaction mistakes come up most?

• Inconsistent codes. “Customer A” in the contract is “Client 1” in the revenue file. Bidders cannot reconcile, and they ask.
• Redacting the totals. A revenue table with every number blacked out tells a buyer nothing, and it signals something worse.
• Forgetting file names. “Acme Corp master agreement redacted.pdf” undoes the work. Rename files to match the code.
• Leaving spreadsheets live. Hidden columns and other tabs in Excel files often still hold the names. Convert to PDF or delete the data, not just the view.
• Losing the originals. Keep an unredacted master set, mapped to the redacted versions, so you can answer questions and build the disclosure letter.