Data Room for Due Diligence UK: Checklist + Guide

TL;DR. Due diligence is the process where an investor, acquirer, lender, or auditor verifies what you’ve claimed about your business. The data room is where that verification happens. A well-organised data room compresses UK due diligence by 2-4 weeks and reduces the risk of price retrades. This walkthrough is what to upload, in what order, and the five mistakes that cost UK founders weeks of timeline.

Free interactive checklist. Open the M&A Data Room Index Builder for a complete UK due diligence checklist with all 8 categories and per-document tracking. Save as you go, export when done. No account required.

Due diligence data room checklist (downloadable)

48 items across the eight categories UK counsel and buyer’s accountants actually request. The interactive version is at the M&A Data Room Index Builder; the static version below is a quick-reference. Save the page, print it, or copy-paste into your own tracker.

1. Corporate (8 items)

1. Certificate of incorporation
2. Articles of association (current version)
3. Register of shareholders and directors
4. Shareholder agreement (every version)
5. Board minutes for the last 3 years
6. Shareholder resolutions
7. Cap table fully diluted (SAFEs, ASA notes, EMI options, advisor shares)
8. Subsidiary documents (if any)

2. Financial (7 items)

1. Audited or filed accounts (3 years)
2. Management accounts monthly for the last 24 months
3. Cash flow statement (12 months monthly)
4. Financial model with assumptions tab reconciled to management accounts
5. Aged debtors and creditors
6. Bank statements (6 months across all accounts)
7. Outstanding loans, facilities, overdrafts, factoring

3. Commercial (5 items)

1. Top 10 customer contracts (sanitised if confidential)
2. Material supplier agreements
3. Partnership and reseller agreements
4. Customer concentration analysis (top 5 / top 10 by revenue)
5. Customer churn data (monthly, last 24 months)

4. Intellectual Property (5 items)

1. UK trademark registrations and applications
2. Patent filings (granted and pending)
3. IP assignment agreements from founders, contractors, agencies
4. Open-source licence audit
5. Domain name registrations

5. Employees and HR (6 items)

1. Org chart with full names and roles
2. Schedule of all employees with role, salary, notice period
3. Standard employment contract template
4. Key employee contracts (founders, C-suite, anyone over £80k)
5. EMI scheme HMRC notification and option agreements
6. Pension scheme details (auto-enrolment compliance)

6. Property (3 items)

1. Office leases (full executed copies)
2. Equipment leases
3. Sub-lease agreements if any

7. Legal and Compliance (8 items)

1. GDPR / data protection policy
2. Privacy policy as published
3. ICO registration certificate
4. Regulatory licences (FCA, SRA, FSCS as applicable)
5. Schedule of litigation (current, threatened, settled in last 6 years)
6. Insurance certificates (PL, EL, professional indemnity, cyber, D&O)
7. Anti-bribery, anti-modern-slavery, whistleblowing policies
8. Any ICO breach notifications

8. Tax (6 items)

1. Corporate tax returns and computations (3 years)
2. VAT returns and HMRC correspondence
3. PAYE compliance (3 years)
4. R&D tax credit claims and HMRC correspondence
5. Any open or recent HMRC enquiries
6. EMI scheme HMRC valuations

For a per-document tick-box version with progress tracking, use the interactive M&A Data Room Index Builder.

When do you need a data room for investors (UK)?

A data room for investors UK founders set up at three points: (a) seed or Series A due diligence, (b) ahead of an investor update where you need a single secure place for cap table + financials, (c) M&A buyer outreach. The rest of this guide is the operational playbook for all three.

When do you need a due diligence data room?

Five UK situations:

1. Investor due diligence on a fundraise - seed, Series A, Series B onwards
2. M&A buyer due diligence - strategic acquirer, PE firm, family office
3. Lender due diligence - debt facility, venture debt, asset-backed lending
4. Audit due diligence - annual audit, regulatory audit, ICO/FCA inquiry
5. Partnership due diligence - strategic partnership, JV, white-label

The structure is similar across all five. The depth varies.

What is in a UK due diligence pack?

For a UK seed or Series A fundraise, this is the typical request from an institutional VC.

Tier 1 - Always required

• Pitch deck (latest version)
• Financial model with 3-year forecast
• Cap table fully diluted
• Last 12 months management accounts
• Top 10 customer contracts (sanitised if NDA-restricted)
• Incorporation documents (certificate, articles)
• Founder background and CVs

Tier 2 - Frequent at Series A

• Audited accounts (if available)
• Board minutes (last 12 months)
• IP assignments (especially from founders)
• Employment contracts (key employees)
• Data protection policy + ICO registration
• Customer references (3-5 contactable)

Tier 3 - Deep due diligence

• Full contract schedule
• Litigation history
• Insurance policies
• Technical architecture overview
• Open source licence audit
• Tax compliance (corporate, VAT, R&D, EMI)

How do you organise a due diligence data room?

The folder structure that works:

01-Company
  ├── Certificate-of-Incorporation.pdf
  ├── Articles-of-Association.pdf
  └── Cap-Table.xlsx
02-Financials
  ├── Accounts-2024-Audited.pdf
  ├── Management-Accounts-2025-Mar.xlsx
  └── Financial-Model.xlsx
03-Commercial
  ├── Customer-Contract-Anonymised-1.pdf
  └── ...
04-Legal-IP
  ├── IP-Assignment-Founder-1.pdf
  └── ...
05-Team
  ├── Org-Chart.pdf
  └── Key-Contracts.pdf
06-Compliance
  ├── GDPR-Policy.pdf
  └── ICO-Registration.pdf

Use clear filenames. Accounts-2024-Audited.pdf not final_FINAL_v3.pdf.

What is the 4-week due diligence schedule?

Week 1 - set up the room and upload Tier 1 documents. Send the first link. Investor’s analyst reads.

Week 2 - investor’s team raises questions. You respond by adding documents to Tier 2 folders and answering in writing.

Week 3 - partner-level review. Tier 3 documents requested if going deep. Term sheet discussions parallel.

Week 4 - final clean-up. Disclosure letter referencing the data room. Move to closing.

Compress to 2 weeks for a hot round. Stretch to 8 weeks for a thorough M&A buy-side process.

Should you NDA-gate the data room?

Every visitor should sign an NDA before any document opens. The capture should include:

• Full legal name
• Email address
• IP address
• Timestamp
• The version of NDA accepted

Export the audit log weekly. Store in your firm’s compliance archive. This is your defensible record if anything leaks or any post-completion warranty issue arises.

How do you track who is reading what?

Page-level analytics tell you which investors are seriously engaged.

A heavily-engaged investor:

• Returns to the room 3+ times in a week
• Spends 20+ minutes total per visit
• Reads the financial model assumption tab and the customer contracts
• Asks specific Q&A based on what they read

A tyre-kicker:

• Opens the room once, never returns
• Spends under 5 minutes
• Reads only the pitch deck

You don’t have to choose between investors based on this - but knowing who’s serious vs not changes how you allocate your follow-up time.

What are the 5 due diligence data room mistakes?

1. Same link for everyone

Without per-recipient links, you can’t trace who accessed what. Use per-recipient links.

2. Email-attached documents instead of room

Email creates copies outside your control. Use the room.

3. No NDA gate

Without acceptance capture, you have no defensible record if a document leaks. Enable NDA gating.

4. Inconsistent filenames

final_v3.pdf, final_FINAL.pdf, final_FINAL_real.pdf - all in the same folder. Investor’s counsel will write you off as disorganised. Rename properly before uploading.

5. Forgetting the disclosure letter

A disclosure letter is a document that references the data room and lists everything that “but for” disclosure would be a warranty breach. UK lawyers expect this. Without it, you’re warranting things that the buyer already knows about.

How does Beamprobe help with due diligence?

• Per-recipient links with one-click bulk creation
• NDA gate with custom text and CSV/PDF audit export
• Page-level analytics - see who reads what for how long
• Bot filtering - Mimecast/Proofpoint scanners excluded automatically
• UK data residency - Cloudflare R2 (EU jurisdiction) by default
• £29/month flat - works out to £58 for a typical 8-week fundraise

Set up your due diligence data room →

Related reading

• Free virtual data room - 5 free options compared

• Best UK virtual data room providers compared

• The UK Data Room Guide

• M&A Data Room: A Practical Guide for UK Founders

• GDPR-Compliant File Sharing

• Virtual Data Room Free Trial: What to Actually Test in 14 Days

• Data Room for SMEs: A UK Guide for Sub-£50m Deals