Virtual Data Room Glossary

Plain-language definitions of terms used across virtual data rooms, M&A due diligence, and EU data protection.

All Terms

  • AES-256 — 256-bit Advanced Encryption Standard — the industry baseline for at-rest encryption in VDRs.
  • Audit Trail — A tamper-evident record of every action in a virtual data room.
  • BSI C5 — Germany's Cloud Computing Compliance Criteria Catalogue.
  • Bulk Upload — Drag-and-drop upload of large folder hierarchies with automatic indexing.
  • Buy-Side — The buyer's side of an M&A transaction.
  • Controller and Processor — Two GDPR roles defining who decides the means and purposes of data processing (controller) and who processes on the controller's instructions (processor).
  • Data Residency — The country or region where data is physically stored.
  • Data Room Index — The master document listing every document in the VDR with metadata.
  • Data Sovereignty — The principle that data is subject to the laws and supervision of the country in which it is stored or processed.
  • Document Redaction — Removing personal data, commercial sensitive information, or confidential identifiers before disclosure.
  • DORA (Digital Operational Resilience Act) — EU regulation creating an ICT risk-management framework for the financial sector.
  • DPA (Data Processing Agreement) — The Article 28 GDPR contract between controller and processor.
  • Due Diligence — The systematic investigation a buyer performs on a target company before signing a transaction.
  • Dynamic Watermarking — Stamping every viewed page with the viewer's identity to deter unauthorized redistribution.
  • eIDAS — EU regulation on electronic identification, signatures, and trust services.
  • Fence View — A view-only mode that obscures parts of the screen except where the cursor hovers, defeating photographic exfiltration.
  • GDPR (General Data Protection Regulation) — The EU's principal data-protection law in force since 2018.
  • Granular Permissions — Per-user, per-folder, per-document access control — the foundation of a deal-grade VDR.
  • IPO (Initial Public Offering) — The first public sale of a company's shares to investors on a stock exchange.
  • ISO 27001 — International information-security management system standard.
  • ISO 27018 — Code of practice for protecting PII in public cloud services.
  • M&A (Mergers and Acquisitions) — Transactions involving the sale, purchase, or combination of companies and businesses.
  • Multi-Factor Authentication (MFA / 2FA) — An additional authentication factor beyond password — typically TOTP, push, or hardware token.
  • NDA (Non-Disclosure Agreement) — A contractual obligation of confidentiality typically required before a bidder receives VDR access.
  • NIS2 Directive — EU cybersecurity directive replacing NIS1; transposition deadline 17 October 2024.
  • NPL (Non-Performing Loan) — A loan in default or near default; sold by banks to specialist investors.
  • OCR (Optical Character Recognition) — Conversion of scanned PDFs and images into searchable, indexable text.
  • Q&A Module — The Q&A module routes questions from bidders through coordinators to subject-matter experts, captures the answer canonically, and writes it back to bidders.
  • SCC (Standard Contractual Clauses) — European Commission-approved contractual clauses for transferring personal data outside the EEA.
  • Schrems II — The 2020 CJEU ruling on EU-US personal data transfers.
  • Sealed Cloud — An architecture in which the operator cannot access stored or processed plaintext.
  • Sell-Side — The seller's side of an M&A transaction — the party disposing of assets, shares, or a business.
  • Smart Index / Auto-Index — Automatic numbering and folder ordering applied to uploaded documents.
  • SOC 2 — AICPA-developed audit framework based on five trust services criteria.
  • SSO (Single Sign-On) — Federation that lets users sign in with their corporate identity provider rather than a separate VDR password.
  • Sub-Processor — Any third party engaged by a processor to process personal data on the controller's behalf.
  • TIA (Transfer Impact Assessment) — A documented assessment of whether transferring personal data outside the EEA satisfies GDPR Chapter V.
  • TLS 1.3 — Transport Layer Security version 1.3 — the modern protocol for in-transit encryption.
  • View-Only Mode — Document access without download or print capability.
  • Virtual Data Room (VDR) — A virtual data room (VDR) is a secure online platform for sharing confidential documents during European M&A, fundraising, and due diligence transactions.