So you've spoken with an investor who seems incredibly excited about your business. She can't wait for you to give them the access to your dataroom and to be fair, you can't either. But then you realise that you have all sorts of sensitive information there: information about your business, your customers, your investors... information that might be sensitive if it got out. What to do?

You might think that signing an NDA (Non-Disclosure Agreement) is the way to go. That would protect you right? Plus it should be pretty straightforward thing to sign, right? After all they promise not to disclose anything and even better, usually to destroy the materials after they don't need them! "Of course I should have them do an NDA" you think.

Except that is quite likely the wrong train of thought. NDAs, despite their ostensible usefulness, tend to have very little commercial (or even legal) value in fundraising with investors. You heard that right - very little value. Here is why:

NDAs create friction when momentum is key

Any sort of an additional legal document that needs to be signed creates friction. Fundraising is all about keeping the momentum going. Speak with an investor, send the deck, open the dataroom, answer their questions... boom, boom boom. NDA at any point will create friction and cause the investor to frown. In any case, that's not the most important point - read further.

Institutional VCs have incredible bureaucratic processes for signing NDAs

Having personally worked in some highly established and mature funds I've experienced how something as seemingly simple as NDA may require multiple internal approvals and redline. For us, it was easily a week long process because it's never a priority item for anyone to review, approve, let alone sign. Yet because investors manage institutional money they often have no choice but to have these onerous checks and balances in place that require all legal documents, including NDAs, to go through a full approval process.

VCs literally do this for living and have NDAs built into their employment contracts

Going through datarooms is something VCs literally do for living. If an investor was to share around some sensitive information that obviously comes from someone else's dataroom, that investor wouldn't be in her profession for long. And they know it, which is why they don't do it.

But that's not the reason. VCs literally see hundreds of datarooms over the course of a year. If you're not the one for them, they frankly won't care of your business and probably forgot about the entire dataroom already. Don't worry, you're not that important. So skip the NDA.

Finally, investors have standard NDAs as part of their employment contracts with the fund. So having another NDA signed would really just be like wearing suspenders in addition to belt - another layer of protection, but likely excessive.

What would you really do if they breached the NDA?

Ok you just insisted on the NDA and then what? How will you show that an investor has actually breached the contract? Even if you did, are you really going to sue them? It would need to be something extremely egregous for you to do that and even then, your runway will take a major hit because (surprise) lawyers are bloody expensive and these processes take a long time. Plus, it's going to leak and it's not going to look good for anyone. But rest assured, for the reasons stated above this is a scenario that is just highly unlikely to happen. 

Of course it's never a bad idea to have an NDA, but it is usual to skip the NDA for fundraising. For any other purposes? Sure go for it. I've seen some very late stage and established businesses share comprehensive datarooms without ever asking for NDAs. If you want, feel free to watermark the files sure and if you are concerned that an investor is fishing for information for their competing portfolio companies, maybe simply don't let them in in the first place.

Whatever you do just make sure you use a good dataroom provider like Notion Rooms to conduct your fundraise. It is a best practice to revoke an investors' access if, after a certain period of time, it seems they are not doing anything in your dataroom.