Selling a business confidentially in Australia means controlling who learns what, and when, at each stage of the process. Buyers see an anonymous teaser first and sign a non-disclosure agreement before anything identifying is released. Personal information stays out of the data room until late. But confidentiality is not absolute: landlords, lenders and key customers often have contractual consent rights, and since January 2026 some acquisitions must be notified to the ACCC and appear on a public register.
What you are actually protecting against
M&A Advisor vs Business Broker sets out why a publicly listed business and a confidentially marketed one are different propositions. This article assumes you accept that and want to know how confidentiality is actually managed.
Everything below assumes a business in the $2M to $25M EBITDA range being sold through a private, negotiated process rather than a public listing.
The risk is specific, and it shapes the method. The damage from a premature disclosure is not embarrassment. Your best staff start taking calls from recruiters, your largest customer quietly begins a tender to reduce its dependency on you, your suppliers shorten terms because they are unsure who they will be dealing with, and a competitor who now knows you are selling has every reason to make life difficult while you are distracted. Each of those reduces the earnings a buyer is valuing, at exactly the moment you are being valued. A confidentiality breach is a price event.
The staged disclosure sequence
Confidentiality in a sale process is managed by releasing information in tranches, with each tranche conditional on the buyer giving something up first. Our analysis of the Australian mid-market indicates the following sequence works.
| Stage | What the buyer gets | What they must do first |
|---|---|---|
| Approach | A blind teaser: sector, approximate size, headline financials, no identifying detail | Nothing. It should be impossible to identify you from this document. |
| Qualification | Confirmation the opportunity is real, and an indication of process timing | Confirm who they are, that they can fund a transaction, and their interest is genuine |
| Information memorandum | The full business story: name, history, customers described but not named, detailed financials | Sign a non-disclosure agreement |
| Management meeting | Access to you and, later, selected members of your team | Submit a non-binding indicative offer |
| Data room, phase one | Contracts with counterparties redacted, financial detail, operational documentation | Be shortlisted, and accept data room access terms |
| Data room, phase two | Named customers, unredacted key contracts, employee detail in de-identified form | Be the preferred or exclusive party |
| Confirmatory | Site visits, staff introductions, direct customer contact where unavoidable | Signed agreement or an advanced, well-progressed position |
The most damaging information, meaning who your customers are, what they pay, and who your key people are, is released last and only to a party that has committed. A process that hands over a full data room in exchange for a signed NDA and nothing else has given away its leverage and its protection at the same time.
What a non-disclosure agreement does, and what it does not
An NDA is worth having, and it is not a technical control. Both halves of that matter.
It is enforceable. Australian courts will grant injunctions to restrain threatened misuse of confidential information, award damages for breach of contract, and in appropriate cases order an account of profits. There is also an equitable duty of confidence that exists independently of any contract, so a party who receives obviously confidential information in circumstances importing an obligation of confidence is bound whether or not they signed anything.
Two drafting points. Make sure there is consideration, or execute the agreement as a deed, because equitable remedies including injunctions may be unavailable if consideration cannot be demonstrated. And avoid indefinite or excessively long confidentiality periods, which risk being unenforceable as a restraint of trade. A defined period that is actually defensible protects you better than a perpetual one that a court will not enforce.
An NDA gives you a remedy after the fact. It does not remove information from a competitor’s head, and return or destruction clauses are largely cosmetic in that respect. This is the reason staged disclosure matters more than paperwork: the strongest confidentiality control is not sending the information in the first place.
Which is also the argument for thinking carefully about approaching direct competitors. Sometimes a competitor is the best buyer and should be approached. But they should be approached later, given less, and given it more slowly than other parties, and that decision should be deliberate rather than accidental.
The data room, and the privacy problem most sellers miss
Australian privacy law applies to a business sale, and there is no exemption for it. The OAIC has published guidance specifically on selling a business, and its position is that a vendor should only provide a prospective purchaser with personal information where doing so is consistent with the vendor’s own obligations about use and disclosure.
In practice that means keeping personal information out of the early data room almost entirely. Financial records, supplier contracts and aggregated or de-identified data are fine. Customer names and identifiers, and identifiable employee records, are not, and the OAIC recommends de-identifying wherever possible. Employee information can be presented as roles, tenure bands and salary bands without names, which is enough for a buyer to model the cost base.
The OAIC’s guidance states that a purchaser accessing personal information without making or keeping a record of it is not "collecting" that information. Taking copies is collection, and triggers the full set of privacy obligations for the buyer. The practical consequence is that a view-only data room with downloads and printing disabled keeps a buyer outside collection for anything they merely look at, which is a meaningful protection for both sides and takes about five minutes to configure.
Do not over-rely on the employee records exemption. It covers an employer’s handling of its own employee records in the employment relationship. It does not extend to unsuccessful applicants, contractors or volunteers, and the OAIC’s position is that using employee data for purposes outside the employment relationship attracts full compliance obligations. Transferring identifiable HR files to a third party acquirer is not what the exemption was designed for.
A structural point worth knowing. Where the whole business or the shares change hands, the personal information stays inside the same entity and no disclosure occurs. Where customer data is bought and sold as a discrete asset, individual consent is generally required. That makes a share sale materially cleaner from a privacy perspective than an asset sale.
Where confidentiality is taken out of your hands
There are points in an Australian sale process where disclosure is forced. Planning for them is more useful than pretending they are avoidable.
ACCC notification, and the public register. Since 1 January 2026, acquisitions meeting the notification thresholds must be notified to the ACCC, and the ACCC publishes them on a public Acquisitions Register generally within one business day of the effective notification date. Its merger process guidelines state that, apart from two narrow exceptions covering surprise hostile takeover bids and transfers of regulated financial entities, it is required to publish details of notified acquisitions and cannot accommodate requests for a confidential assessment. Confidentiality can be claimed over specific commercially sensitive content, but not over the existence of the deal or the identity of the parties.
Two features make this a genuine risk for a mid-market seller. First, the obligation sits with the acquirer, not you, so it is not yours to control or waive. Second, the threshold that catches ordinary mid-market sales is the very large acquirer test: notification is mandatory where the acquirer group has Australian turnover of at least $500 million and the target has Australian turnover of at least $10 million. A business with $2M in EBITDA and $12M in revenue, sold to a large trade buyer or a private equity backed platform, is squarely within it. A serial acquisitions test can also capture buyers who have been rolling up businesses in the same sector. For the full notification tests, see Do You Need ACCC Approval to Sell Your Business?
Notification waivers do not solve it, because waiver applications and the ACCC’s decisions on them are generally published too. Pre-notification engagement with the ACCC is available confidentially, before formal notification, which is where the timing can be managed.
Ask any serious buyer early, in the first substantive conversation: will you be required to notify this acquisition to the ACCC, and if so, when do you propose to do it? Their answer determines the date on which your sale stops being private, and it lets you sequence your staff and customer communications around it rather than being overtaken by them.
- Change of control and consent clauses. Commercial leases, bank facilities, franchise agreements, software licences and major customer and supply contracts commonly contain clauses requiring consent to, or giving termination rights on, a change of control. In an asset sale, contracts must be novated or assigned, so counterparty consent is unavoidable as a matter of contract law. In a share sale, a change of control clause reproduces the same requirement. Because consent is usually a condition precedent to completion, the counterparty has to be told before the deal is certain, at a point where it can still fail. Auditing your material contracts for these clauses early, and planning the order and manner of those conversations, is one of the highest-value pieces of preparation there is.
- Employee consultation. Modern awards and enterprise agreements contain a consultation term requiring an employer to notify and discuss major workplace change once a definite decision has been made. The important nuances are that the trigger is a definite decision rather than an exploration, so running a process, appointing an advisor and taking indicative offers do not engage it; that a share sale often does not involve major change at all, since the employing entity and terms are unchanged; and that the standard clause contains an express carve-out permitting an employer to withhold confidential information where disclosure would be contrary to its interests. That carve-out lets you consult on the effects on employees without disclosing price or buyer identity. Any enterprise agreement in force should be read on its own terms, because some are drafted more broadly than the model clause and expressly name a change of ownership.
Telling your own people
There is no rule about when to tell staff, only a trade-off. Tell people early and you extend the window in which the information can spread and in which uncertainty affects behaviour. Tell people late and you risk them hearing it from someone else, which is worse than either.
Our analysis of the Australian mid-market indicates the following works. Keep the circle genuinely small at the outset: usually the owner, one internal person if the process cannot run without them, and your external advisors. Where a senior employee has to be involved, for example a finance manager who must produce the numbers, bring them inside deliberately, tell them what is happening, and have them sign a confidentiality agreement, rather than leaving them to work it out from unusual requests. People who are trusted early rarely leak; people who deduce it and feel excluded sometimes do.
Beyond that, tie the announcement to certainty rather than to a date. The natural point is when the deal is signed and conditions are substantially satisfied, so that you are telling people what is happening rather than what might. The exception is where an external event, an ACCC register entry, a landlord consent request, a customer novation, will get there first. In that case announce ahead of it, on your terms.
Decide in advance what you will say to a direct question. "We regularly get approaches and we look at all of them" is true for most businesses and answers a rumour without confirming or denying anything. Being caught without an answer is what turns a question into a story.
If it leaks anyway
Assume at some point in a long process that someone will hear something. What matters is the response, and speed matters more than polish.
- Establish what has actually got out and to whom, before responding to anything. Rumours are usually vaguer than they feel in the moment, and over-responding to a small one creates a large one.
- If the source is a party under NDA, act on it immediately. Urgent injunctive relief is available in Australia to restrain threatened misuse, and the practical value of moving quickly is as much about signalling to other parties in the process as about the remedy itself.
- Talk to your key people directly and in person, before they hear more. The consultation confidentiality carve-out lets you address what it means for them without disclosing commercial terms.
- Contact major customers yourself rather than letting them raise it. A customer who hears it from you and is told what it means for their supply is usually reassured. One who hears it from a competitor is not.
- Do not accelerate the process to outrun the rumour. Buyers read urgency accurately, and a seller who suddenly needs to move quickly has just weakened their own negotiating position.
The limits
A well run process protects confidentiality substantially better than a public listing, and the difference is real. But complete secrecy until settlement is not achievable in most mid-market sales, and an advisor who promises it is overselling.
Landlords and lenders will usually need to be asked. Key customers with change of control rights will usually need to be asked. If the buyer is large enough, the ACCC will publish the deal. Your accountant, your lawyer, the buyer’s accountants and lawyers, financiers and insurers will all know. The realistic objective is not that nobody finds out. It is that the people who need to know find out in an order you chose, at a time you chose, from you rather than from someone else.
In a management buyout, the buyer already knows everything, there is no competitor exposure, and much of what is described in this article falls away. Owners for whom confidentiality is the dominant concern sometimes find that the route matters more than the technique.
Where M&A Concierge fits
Confidentiality is largely a function of process discipline, and process discipline is a function of who is running it. An advisor who has run twenty processes in your sector knows which buyers respect an NDA, which have a history of using diligence access to gather intelligence, how to stage a data room, and when to bring a competitor in. That judgement is not something an owner can reasonably acquire for a single transaction.
M&A Concierge works on M&A advisor selection: matching business owners with the right advisor for their business, drawn from a proprietary M&A advisor database spanning 100+ industry sectors across the Australian mid-market. Our fee is a uniform referral rate model, paid by the advisor rather than by you, and the rate does not change according to which advisor is recommended. How to Find the Right M&A Advisor in Australia sets out what to look for if you would rather run that search yourself.
Release information in stages, with each stage conditional on the buyer committing further. Buyers see an anonymous teaser first, sign a non-disclosure agreement before receiving anything identifying, and only reach named customers, unredacted contracts and staff introductions once they are the preferred party. Keep personal information out of the data room, use view-only access, and audit your material contracts early for change of control clauses that will force disclosure to landlords, lenders or key customers.
Usually until late in the process, but rarely all the way to completion. The circle should start very small, and any employee who has to be involved in producing information should be brought in deliberately and put under a confidentiality agreement rather than left to deduce it. Most owners announce once the deal is signed and conditions are substantially satisfied. If an external event such as a landlord consent or an ACCC register entry will surface it earlier, announce ahead of that rather than being overtaken.
Yes. Under the mandatory merger regime that commenced on 1 January 2026, the ACCC publishes notified acquisitions on a public Acquisitions Register generally within one business day of the effective notification date, and its guidelines state it cannot accommodate requests for confidential assessment other than in two narrow exceptions that do not apply to a private negotiated sale. Notification is mandatory where the acquirer group has Australian turnover of at least $500 million and the target has Australian turnover of at least $10 million, among other tests. The obligation sits with the buyer, so ask any serious buyer early whether they will need to notify and when.
Yes. Australian courts grant injunctions to restrain threatened misuse of confidential information, award damages for breach, and can order an account of profits. There is also an equitable duty of confidence that applies independently of any contract. Two practical points: make sure there is consideration or execute the agreement as a deed, since equitable remedies may be unavailable without it, and avoid indefinite confidentiality periods, which risk being unenforceable as a restraint of trade. An NDA gives you a remedy after a breach; it does not prevent one, which is why staged disclosure matters more.
Sometimes, because a competitor is often the buyer with the strongest strategic reason to pay a premium. But the decision should be deliberate. Bring competitors into the process later than other parties, give them less at each stage, and hold named customer information and pricing detail back until they are the preferred party under exclusivity. The risk is not theoretical: a competitor who does not proceed still leaves with whatever you showed them.
Financial records, supplier contracts, operational documentation and aggregated or de-identified data early. Personal information should be kept out or de-identified: the OAIC recommends avoiding customer names and identifiers during due diligence, and employee data can be presented as roles, tenure bands and salary bands. Use view-only access with downloads disabled, since the OAIC’s guidance indicates a buyer who accesses personal information without keeping a record of it is not collecting it, which reduces obligations on both sides.
Usually yes, before completion. Commercial leases and bank facilities commonly contain change of control or assignment clauses requiring consent, and that consent is normally a condition precedent to completion, which means the conversation happens while the deal can still fall over. This is not avoidable, but it is manageable if you audit your material contracts early and plan the order and framing of those approaches rather than discovering them in due diligence.
Establish what has actually got out and to whom before responding, since over-reacting to a vague rumour creates a bigger one. If the source is a party under a non-disclosure agreement, act immediately, because urgent injunctive relief is available and moving quickly also signals to everyone else in the process. Speak to key staff and major customers directly and before they hear more, and do not accelerate the process to outrun the rumour, because buyers read urgency accurately and will price it.