Non-disclosure agreement (NDA) in a business sale

The NDA protects your information after a leak — not before. It’s a legal remedy, not prevention.

That’s why it’s necessary — but not sufficient.

Why an NDA is necessary

Before sharing anything about your business — numbers, clients, suppliers, strategy — a prospective buyer has to sign a non-disclosure agreement.

That’s the NDA (Non-Disclosure Agreement), also called a confidentiality agreement.

Without a signed NDA, nothing stops the buyer from sharing the information they receive. Not just your financial data — also the fact that your business is for sale.

That’s explosive information, especially in a Quebec SME where business networks overlap: suppliers, clients, and competitors often move in the same circles. If your employees, clients, or suppliers hear about it at the wrong moment, the consequences can be serious.

The NDA is the first layer of protection in a confidential business sale process in Quebec. Without it, the process shouldn’t start.

What an NDA typically covers

Every NDA is different, but most cover these five elements.

1. The definition of confidential information

Everything shared during the process is confidential: financial statements, confidential information memorandum (CIM), client lists, operational data — and the very existence of the discussions.

The definition has to be broad enough to cover everything, but clear enough to be enforceable.

2. The signatory’s obligations

The buyer commits to:

• not disclose the information to third parties (except their professional advisors, under the same obligations)
• not use the information for anything other than evaluating the transaction
• protect the information with the same care they’d give their own

3. The duration

The NDA stays in force even if discussions don’t lead anywhere.

Typical duration: 2 to 3 years after discussions end. That’s the period during which the buyer remains bound by their obligations — even if they never made an offer.

4. The exceptions

Certain information isn’t covered:

• information already public at the time of disclosure
• information the buyer already had independently
• information the buyer is legally required to disclose (court order, regulatory requirement)

5. The consequences of a breach

The NDA typically provides that the seller can seek damages AND an injunction to stop the disclosure.

That’s the remedy. But in practice, proving the breach and obtaining relief takes time and money.

What an NDA does NOT protect

This is the most important section of this article.

An NDA gives you a legal remedy after a leak. It doesn’t prevent it.

If a buyer breaks the NDA and talks — to a competitor, to an employee, to a supplier — the damage is done. The NDA gives you the right to sue. But your employees’ trust or your clients’ loyalty doesn’t come back in a courtroom.

That’s why the NDA has to come with a structured process

Real protection is the combination:

• Signed NDA before any information is shared
• Anonymized CIM in the early stages — the buyer evaluates the opportunity without knowing which business they’re looking at
• Controlled virtual data room — information is shared in stages, not all at once
• Business broker as the single filter — the buyer never contacts the seller, the employees, or the clients directly: everything goes through the broker

The non-solicitation clause

A good NDA includes a non-solicitation clause: the buyer commits to not approach the business’s employees or clients directly during and after discussions.

It’s a protection that often gets overlooked — and yet it’s essential.

And when the NDA hasn’t been enough, what follows is a structured response to a confidentiality leak during a sale: assess the scope, control the source, communicate with the right people at the right moment. The same discipline applies upstream to the decision to inform employees about the sale — which prevents the risk as much as it manages it.

Unilateral vs mutual NDA

The unilateral NDA

That’s the standard in M&A.

Only the buyer is bound. The seller shares sensitive information — the buyer commits to protecting it. The seller, in turn, makes no reciprocal commitment.

That’s the right format for the vast majority of SME sales.

The mutual NDA

Both parties commit to each other.

It’s less common — except when the buyer is also sharing sensitive information. For example: a publicly traded buyer who doesn’t want their acquisition interest disclosed, or a strategic buyer revealing expansion plans.

What to check before having it signed

Not all NDAs are equal. Before sending yours to a prospective buyer, check these points:

1. Is the scope appropriate? — Broad enough to cover all the information shared, precise enough to be enforceable in court.

2. Is the duration reasonable? — 2 to 3 years is standard. Less than a year isn’t enough to protect sensitive information.

3. Is non-solicitation included? — The buyer can’t approach your employees or clients directly.

4. Is the jurisdiction right? — The NDA should be governed by the laws of your province.

5. Is the NDA suited to the M&A context? — A generic template pulled off the internet doesn’t cover the specifics of a business sale. An M&A NDA is a specialized document.

6. Are the consequences proportionate? — Serious enough to deter, realistic enough to be enforceable.

If you want to understand how to protect the confidentiality of your Quebec SME sale process, a confidential conversation about your file is a good place to start.