M&A Data Room Checklist (Sell-Side)

A sell-side data room checklist is the master document the seller uses to populate a VDR for a European M&A process. The list below is the consolidated version of the major European mid-market checklists used by Big Four advisors, EU law firms, and corporate finance houses. It is deliberately longer than the fifteen-document short list that circulates as a starter virtual data room for mergers and acquisitions checklist: that version is enough to open a phase-1 room, while the nine sections here are what a buyer's counsel will work through before signing.

Work the checklist inside the room rather than in a spreadsheet beside it: the nine sections below map one-to-one onto the folder tree, so a gap in the list is visible as an empty folder. That only works in an M&A data room where an unreleased section is absent from a bidder group's view rather than greyed out, because a visible-but-locked folder named 05 Legal has already disclosed something you had not chosen to disclose yet. Papermark is best for mid-market sell-side processes that need that mapping without a procurement cycle: folder- and file-level permissions per bidder group, dynamic watermarking and download controls on the sensitive sections, and page-by-page analytics that show which of the nine workstreams a bidder actually opened, which is the earliest signal that an item is missing or unreadable. Hosting defaults to ISO 27001-certified data centres in Frankfurt, the platform is SOC 2 Type II certified and GDPR compliant, and the Data Rooms plan at EUR 99/month covers unlimited rooms, so the vendor-diligence room and the live process room can run in parallel on one subscription.

Published: May 2026. Updated: 19 September 2026.

01. Corporate

  • Articles of association / statutes (current and historical).
  • Shareholder register and cap table.
  • Shareholder agreements and voting trusts.
  • Board minutes (last 5 years).
  • Resolutions of significant transactions.
  • Subsidiary register, organigramme.

02. Financial

  • Audited financial statements (last 3-5 years).
  • Management accounts (monthly, last 24-36 months).
  • Working capital analysis.
  • Debt schedule and loan agreements.
  • Cash flow forecast / business plan.
  • KPI dashboard and segment reporting.
  • Bank statements and reconciliations.
  • Capex history and forecast.

03. Tax

  • Tax returns (corporate, VAT, payroll): last 3-5 years.
  • Tax assessments and ongoing audits.
  • Transfer-pricing documentation.
  • VAT registrations and historical position.
  • Deferred tax position.

04. Commercial / Customer / Supplier

  • Customer list (top 20 by revenue, with contract copies).
  • Customer churn analysis.
  • Pricing schedule.
  • Supplier list (top 20 by spend, with contract copies).
  • Distribution / agency agreements.
  • Sales pipeline.

05. Legal

  • Material contracts (above defined threshold).
  • Joint ventures, partnerships.
  • Real-estate leases (own-use and investment).
  • Insurance policies and claims history.
  • Permits and licences.
  • Litigation register (current and last 5 years).

06. Intellectual Property

  • Patent register.
  • Trademark register.
  • Domain names.
  • Software licences (in and out).
  • IP assignments from employees and contractors.
  • Open-source compliance register.

07. IT and Cybersecurity

  • IT system landscape.
  • Cybersecurity policies and last penetration test.
  • GDPR record of processing activities (Article 30).
  • Sub-processor list and DPA register.
  • Incident register.

08. HR

  • Org chart and headcount by function.
  • Senior-management contracts.
  • Standard-form employment contract.
  • Pension and benefits arrangements.
  • Works-council and union agreements.
  • Litigation and grievance register.

09. Environmental and ESG

  • Environmental permits and audits.
  • Phase I / Phase II reports for owned property.
  • Carbon and energy reporting.
  • CSRD-aligned ESG data.

Frequently Asked Questions

Should the seller redact personal data before bidder access?

Yes. Pre-redaction of employee, customer, and supplier personal data is the GDPR-clean baseline for European M&A.

How early should the seller start populating the VDR?

Typically four to eight weeks before the planned launch of phase-1 marketing.

Further Reading