Data room due diligence checklist for UK deals

A data room due diligence checklist for a UK deal covers the documents a buyer's advisers request, the UK-statutory items that differ from generic checklists, and the data room configuration that protects both sides. The core statutory workstreams are corporate, employment (TUPE), property (Land Registry), financial, regulatory and contractual.

For UK deal teams that need EU-hosted storage, an NDA gate and a room live the same day, Papermark's Data Rooms plan at $99 per month covers unlimited data rooms with an exportable audit log, which satisfies the disclosure letter requirements most UK sell-side advisers impose.

This article focuses on the broader due diligence context and the UK-specific statutory requirements that any UK deal needs, as a complement to the more detailed UK M&A data room checklist covering the eleven workstreams of a structured sale. For a scored comparison of providers, see the ranked UK data room guide.

The short answer: what a UK data room checklist must include

A UK due diligence checklist differs from a generic one in three ways. First, UK company law requires specific Companies House filings: confirmation statements, charge registrations, and persons with significant control registers are all publicly searchable and discrepancies will be found. Second, TUPE employee liability information has a statutory form and a mandatory deadline of 28 days before completion, and it covers every transferring employee. Third, the National Security and Investment Act 2021 screening requirement applies to acquisitions in 17 sensitive sectors and has no EU equivalent. None of these appear in generic international checklists drawn up for US or continental European deals.

The data room must also be configured to protect each workstream: TUPE schedules require restricted access, NSI pre-notification documents require version control, and the overall audit log must be exportable for the disclosure letter. For a full explanation of UK GDPR data residency requirements and where deal data must sit, see the residency guide. For the specific question of when an IDTA or UK Addendum is required for overseas buyer access, see the guide to UK GDPR and where your deal data is allowed to sit.

The sections below cover each workstream in turn, followed by configuration guidance and the common mistakes that delay or endanger a UK deal.

01. Corporate and constitutional documents

The corporate workstream is always opened first, because gaps here signal problems in every other workstream. A company whose statutory books have not been maintained will have unsigned contracts, unregistered charges and PSC register entries that do not match the cap table. The corporate workstream also produces the majority of the exhibits to the disclosure letter.

Every item below should be the executed version, not a draft. Companies House provides official copy entries for most of these, and a mismatch between what is filed and what is held internally is itself a disclosure issue that must be remedied before the data room opens.

• Certificate of incorporation and company name history (from Companies House)
• Current articles of association and all prior versions filed at Companies House
• Latest confirmation statement (CS01) and any outstanding filings
• Register of members, register of directors, and persons with significant control register
• Board minutes from the last three years: full and unredacted
• All shareholder agreements, including drag-along rights, tag-along rights and any pre-emption waivers
• Group structure chart with subsidiary incorporations and jurisdictions
• Powers of attorney currently in force
• Register of charges and a Companies House search confirming registered and satisfied charges
• Any pending or threatened litigation from the last three years

02. Employment and TUPE: the UK-specific workstream

TUPE (Transfer of Undertakings (Protection of Employment) Regulations 2006) is the single most UK-specific workstream in any deal involving a business transfer. Regulation 11 requires the seller to provide employee liability information to the buyer no later than 28 days before completion. The statutory form of that information covers each transferring employee's identity, age, particulars of employment (as would appear in a written statement under the Employment Rights Act 1996), information about collective agreements that will transfer, any disciplinary action taken against the employee in the last two years, any grievance raised by the employee in the last two years, and any pending or threatened employment claims. A failure to provide this information in statutory form and on time exposes the seller to a compensation claim at the Employment Tribunal.

IR35 determinations for off-payroll workers must also be disclosed. Since April 2021, medium and large businesses in the private sector are responsible for determining the employment status of contractors. Status Determination Statements (SDS) for all off-payroll workers should be in the data room, along with any HMRC enquiries relating to IR35 determinations. A buyer inheriting an incorrect IR35 determination inherits the associated tax liability, and a thorough buy-side adviser will ask for these specifically.

Because TUPE schedules contain highly sensitive personal data under UK GDPR, including salary, age and disciplinary history for every transferring employee, this folder must be restricted to named individuals and should carry dynamic watermarking. Access should be released only to shortlisted bidders, not to all parties in an information-only phase.

• TUPE employee liability information in statutory form (Reg 11)
• Contract templates and individual contracts for senior employees
• Collective bargaining agreements currently in force
• IR35 Status Determination Statements for all off-payroll workers
• Any pending or threatened Employment Tribunal claims
• Redundancy consultation records from the last three years

03. Property and real estate: Land Registry checks

For a UK deal with real estate, title must be verified against HM Land Registry. Official copy entries (OC1 filings) establish what is registered and what charges are noted against each title. Title plans must be checked against the physical boundaries the business occupies. For leasehold properties, the terms of the lease, any licences to alter and any consent requirements on assignment must be in the data room before a buyer can confirm the business can continue trading from its premises post-completion.

Scottish property is registered at the Registers of Scotland (either the Land Register of Scotland or the General Register of Sasines) rather than HM Land Registry. If the target has Scottish properties, searches must be obtained separately from Registers of Scotland. The legal concepts differ materially from English land law, and Scottish property will require a Scottish solicitor to review.

• Official copy entries (OC1) for each freehold and registered leasehold title
• Title plans for each property
• Local authority searches, drainage and water searches, and environmental searches
• Replies to CPSE enquiries (Commercial Property Standard Enquiries) from the seller
• Full lease documentation for all leasehold premises, including any licences to alter
• Licences to assign and landlord consents (where required for the transaction to proceed)
• Planning permissions and listed building consents for any material works

04. Financial: three years of accounts and the management information pack

The financial workstream is the largest single demand on the data room in terms of document volume. Three years of audited statutory accounts give a buyer's financial advisers the trend data they need for a quality of earnings analysis. Management accounts for the last 18 months bridge from the last set of audited accounts to the current position. The combination allows the buyer to challenge the information memorandum and to build a model without relying on the seller's own projections.

HMRC compliance records are equally important. Corporation tax computations for all open periods, VAT returns for the last two years, and any open HMRC enquiries or assessments must be disclosed. Any R&D tax credit claims should be included, along with any PAYE settlement agreements. A buyer who completes without sight of these faces potential inheritor liability for deficiencies that a thorough financial adviser would have found in the room.

• Audited statutory accounts for the last three financial years (UK GAAP or IFRS, as applicable)
• Management accounts for the last six months (or the last 18 months where the last audit is more than 12 months old)
• Corporation tax returns and computations (CT600) for all open periods
• VAT returns for the last two years
• PAYE settlement agreements and any open HMRC PAYE enquiries
• R&D tax credit claims and any HMRC correspondence on those claims
• Any open HMRC enquiries or assessments across all taxes

05. Regulatory and compliance: NSI Act, FCA and sector-specific requirements

The National Security and Investment Act 2021 introduced mandatory notification requirements for acquisitions of entities whose activities fall within 17 sensitive sectors defined in secondary legislation. The sectors include advanced materials, artificial intelligence, civil nuclear, communications, computing hardware, critical suppliers to government, cryptographic authentication, data infrastructure, defence, energy, military and dual-use, quantum technologies, satellite and space technologies, synthetic biology, transport, and several others. A notifiable acquisition cannot complete without clearance from the Investment Security Unit or the expiry of the review period, and completing without clearance renders the transaction void. NSI Act pre-notification documents, including a description of the target's activities, its ownership structure and the acquirer's identity and intentions, should be assembled early and held in the regulatory workstream folder.

The FCA change-in-control notification (as set out in FCA FG16/5) applies to acquisitions of FCA-regulated entities. A buyer acquiring 10 per cent or more of a regulated firm must notify the FCA and obtain approval before completion. The evidence pack required by the FCA, covering the buyer's fitness and propriety, its financial position and its intentions, is extensive and takes time to assemble. It belongs in the data room alongside the NSI documentation.

For deals involving public sector buyers, Cyber Essentials certification is required before contract award under Procurement Policy Note 014 (in force from 24 February 2025). The certification evidence must be in the data room if the target is a supplier to central government and the buyer is a public body. For more on how Cyber Essentials applies to UK public sector procurement, see the guide to Cyber Essentials and G-Cloud data rooms.

• NSI Act pre-notification documents for each sensitive sector in which the target operates (if applicable)
• FCA change-in-control evidence pack (if the target is FCA-regulated)
• Cyber Essentials or Cyber Essentials Plus certificate (if required for public sector contract award)
• Sector regulator licences (Ofcom, Ofgem, CQC, and so on, as applicable)
• Environmental permits and Health and Safety at Work documentation, including any HSE improvement notices or prohibition notices

A UK deal scenario: Beaumont Precision Components

Beaumont Precision Components is a fictional UK aerospace component manufacturer based in Derby with 140 employees and a turnover of approximately sixteen million pounds. In September 2026, the company received an approach from a German strategic buyer in the same supply chain. The corporate finance adviser confirmed three immediate complications. First, Beaumont's activities as a defence supply chain participant trigger mandatory NSI Act notification, because the target falls within the defence and advanced materials sectors defined in secondary legislation. Clearance will need to be sought from the Investment Security Unit before any completion date can be fixed. Second, 140 employees are caught by TUPE, meaning the Regulation 11 employee liability information pack needs to be ready no later than 28 days before the agreed completion date, in statutory form. Third, the company owns five freehold properties in the East Midlands, all registered at HM Land Registry, two of which carry charges that must be shown as discharged before title can pass.

The sell-side adviser set up the data room in eight workstream folders: corporate and constitutional, employment and TUPE, property, financial, regulatory (NSI and other), commercial contracts, IP and IT, and insurance. Access was staged. In the first phase, all bidders received access to corporate and financial documents only. In the second phase, shortlisted bidders received access to employment, TUPE and property. In the third and final phase, the preferred bidder received access to regulatory and NSI pre-notification documents under a separate confidentiality undertaking.

The NDA gate was configured before any access was granted, so no party could view any document without first countersigning the confidentiality agreement on the platform. Dynamic watermarking was enabled on all TUPE schedules, with each document displaying the viewer's name, company and access timestamp on every page. The Q&A module was configured with a 48-hour response SLA, and questions were routed automatically to the relevant subject-matter expert: employment law questions to the employment solicitors, financial questions to the reporting accountants, NSI questions to the regulatory counsel. At signing, the append-only audit log was exported and provided to the buyer's solicitors as evidence of disclosure for the disclosure letter.

For a deal of this structure, Papermark for UK due diligence provides EU hosting in Frankfurt that satisfies the UK GDPR restricted transfer analysis for the German buyer without requiring a separate International Data Transfer Agreement (IDTA). Frankfurt sits inside the EEA, which is covered by UK adequacy, and Papermark holds SOC 2 Type II and ISO/IEC 27001 certification, which the German buyer's legal counsel can verify from public sources.

Data room configuration for UK due diligence

The document checklist is only half the exercise. A data room that holds the right documents but is configured incorrectly can undermine the disclosure process as badly as a missing document. The three configuration requirements with the greatest legal consequence are the NDA gate, the audit log and dynamic watermarking.

The NDA gate must be enforced by the platform before any document becomes accessible. This means the access link does not resolve to content until the prospective buyer has countersigned the confidentiality agreement within the platform itself. Managing the NDA separately and then sending a link risks the sequence: a party could receive the link before the NDA is fully executed. The countersignature timestamp should be part of the same audit log as the first document access.

The audit log must be append-only and exportable as a single file. UK sell-side solicitors commonly require the audit log as an exhibit to the disclosure letter, so that the buyer's solicitors can confirm which documents each buyer accessed and when. An audit log that cannot be exported in its entirety, or that can be edited after the fact, cannot serve this purpose. A log that records only downloads, not views, is also insufficient: most advisers review documents in-platform and a download-only log will show no access at all for a significant proportion of the review.

• Create separate user groups for the lead bidder, information-only parties and the sell-side team before any access is granted
• Activate the NDA gate before any document is accessible: no document should resolve until the confidentiality agreement is countersigned on the platform
• Enable dynamic watermarking on all folders, embedding the viewer's name, email address and access timestamp into every page
• Unlock workstreams in phases: corporate first, then employment and property for shortlisted bidders, then financial and regulatory for the preferred bidder only
• Assign Q&A questions by category to the relevant subject-matter expert and set a response SLA before the first bidder accesses the room
• Export and archive the audit log at signing as evidence of disclosure for the disclosure letter

Common mistakes in UK due diligence data rooms

Providing access to all documents from day one rather than using staged release is the most common structural mistake. A buyer who can see the TUPE employee schedules and NSI pre-notification documents in the same phase as the management accounts has more information than the seller intended to disclose at that stage. Staged release is a standard feature of purpose-built data rooms and should be planned before the room opens.

Omitting the NDA gate and allowing document access before a confidentiality agreement is signed is a risk that is easy to create by accident when using general-purpose file-sharing tools. A party who accesses documents before any legal obligation of confidence has attached creates a gap in the disclosure record that the seller cannot close retroactively. A purpose-built data room enforces the NDA gate at the platform level, not as a configuration step the seller has to remember.

Failing to maintain an exportable audit log prevents the sell-side from certifying disclosure in the disclosure letter. If the data room cannot produce a record of exactly who accessed each document and when, the sell-side solicitors cannot confirm that specific disclosure was made to specific parties. This is not an administrative inconvenience: it is a legal gap that can affect whether the warranties in the sale and purchase agreement are effectively qualified.

Uploading unsigned or draft versions of key statutory documents is a systematic problem in rooms assembled under time pressure. Every statutory filing should be the version held at Companies House, not an internal working copy. Every contract should be the executed version, not the last draft circulated for signature. Uploading a draft that differs from the executed version creates a disclosure that is technically inaccurate.

Overlooking the NSI Act screening requirement for deals in the 17 sensitive sectors is a risk with severe consequences. An acquisition that completes without mandatory notification is void under the NSI Act 2021, meaning the transaction has no legal effect. The seller and buyer can both face civil penalties. Sector screening should be carried out at the outset of any deal, not after a heads of terms has been signed.

Which data room is best for UK due diligence?

Most UK deal teams choose a provider on four criteria: EU or UK hosting (for the UK GDPR restricted transfer analysis when EU counterparties are involved), an NDA gate enforced by the platform rather than managed separately, an exportable audit log in a format usable in a disclosure letter, and published pricing so that the cost is known before a sales call is required. Billing in euros is the norm even for UK buyers, so all prices below are in the currency the provider actually charges.

Papermark for UK due diligenceis best for deal teams that need EU hosting and published pricing. The Data Rooms plan at $99 per month covers unlimited data rooms on the one plan, an NDA gate, staged folder release, a Q&A module, session-level dynamic watermarking, per-page and per-viewer analytics, and an append-only audit log that is exportable in a single action. For UK financial services firms dealing with EU counterparties, Frankfurt hosting on AWS eu-central-1 also simplifies the DORA ICT third-party risk analysis. For a full scored assessment across security, pricing transparency, UK data residency, deal workflow and support, see the ranked UK data room guide. For published pricing across all providers, see the data room pricing for UK buyers guide.