Click-through NDAs in a data room: how access terms protect the seller

How does a click-through NDA differ from a signed NDA?

The two instruments do different jobs, and most sell-side processes use both.

The point of the click-through is coverage. A bidder’s company may have signed the NDA, but the analyst, the external lawyer and the lender’s credit team who actually read the files did not. Click-through terms put each of them on notice and on record.

Are click-through terms legally binding?

Courts in many jurisdictions have accepted “clickwrap” agreements, where a user must take an affirmative action such as ticking a box or clicking “I agree” after the terms are presented. Enforceability tends to depend on whether the terms were clearly shown, whether acceptance was affirmative and required before access, and whether the user can be identified.

Electronic agreement laws support the general principle. In the US, the federal E-SIGN Act provides that a contract may not be denied legal effect solely because it is in electronic form. In the EU, the eIDAS Regulation sets out the legal effect of electronic signatures, with higher evidential standing for advanced and qualified signatures. The details vary country by country, so take local advice for important deals; this article is not legal advice.

Where do access terms sit in the login flow?

They sit between the invitation and the first document, after identity is established and before anything confidential appears.

In practice the sequence is: a named invitation arrives by email, the user sets a password, a second factor is checked where the room requires it, the terms appear in full, the user accepts, and only then does the index load. If the user declines, nothing opens.

What should the click-through terms say?

Keep them short enough to be read and specific enough to be useful. A typical set covers:

• Reference to the main NDA. The user confirms they are bound by, or acting under, the confidentiality agreement signed by their organization.
• Personal use of credentials. No sharing of logins; each person needs their own invitation.
• No copying or circumvention. No screenshots, photographs, scraping or attempts to defeat watermarking or download restrictions.
• Monitoring. The user acknowledges that activity is logged and may be reported to the seller.
• Purpose limit. Information is used only to evaluate the transaction.
• Return or destruction. Any permitted downloads are destroyed when the process ends or on request.
• Contact for incidents. Whom to tell if a document is sent to the wrong person.

Avoid repeating the whole NDA. Long terms are skimmed, which weakens the argument that the user understood them.

What evidence does the audit trail need to capture?

The acceptance is only as good as the record of it. A useful log entry includes:

Two-factor authentication strengthens the identity element considerably. In our directory, 12 of the 16 providers we track list two-factor login. Compare them in the provider directory, and see how sign-in fits the wider security model in our guide to secure document storage in data rooms.

When is a click-through not enough?

Some situations call for a properly executed signature rather than a click:

• The company-level NDA itself. It is negotiated and signed by authorized signatories, not accepted by whoever logs in first.
• Clean team agreements. Where competitively sensitive data goes only to a restricted group, each member often signs an individual undertaking.
• Reliance and release letters. Letters that govern access to a vendor due diligence report are usually signed documents. Our article on the vendor due diligence report explains them.
• Highly regulated material. Inside information on listed companies, export-controlled technical data or patient data may need specific, signed undertakings.

For these, a signature flow is better. Some rooms include e-signature; in our directory, 4 of 16 providers list it as a built-in feature (Box, DocSend, Ellty and SecureDocs). Others connect to a dedicated signature service or rely on a separate signing step outside the room.

How do you set up access terms for a new room?

1. Sign the company-level NDA first

   Do not invite anyone from a bidder until its organization has signed the main confidentiality agreement.

2. Draft short room-specific terms

   Cover credentials, copying, monitoring, purpose and return of information, with a reference to the main NDA.

3. Turn on mandatory acceptance

   Configure the room so the terms appear on first login and block all documents until accepted.

4. Require a second factor

   Switch on two-factor authentication so each acceptance is tied to a verified person.

5. Version the terms

   Give each version a number and date, and force re-acceptance whenever the wording changes.

6. Export the acceptance log at closing

   Include the acceptance records in the final archive together with the audit trail and Q&A log.

Do access terms help after a leak?

They help, but they do not prevent one. If a document turns up where it should not, the seller can use the watermark to identify the copy, the audit trail to show who viewed or downloaded it, and the acceptance record to show that the person had agreed not to share it. That combination is strong evidence in a dispute with the individual or the bidder.

Prevention depends on the other layers: view-only permissions for the most sensitive folders, dynamic watermarks, download and print restrictions, and staged release so that only shortlisted bidders see the crown jewels. Legal teams setting up rooms for disputes or regulatory matters use the same controls; the legal industry guide covers that use.

What about personal data in the acceptance log?

The log itself contains personal data: names, emails, IP addresses and activity. Under the EU GDPR and similar laws, users should be told what is recorded and why, which is one reason the monitoring acknowledgment belongs in the terms. Keep the log for as long as the deal record requires and no longer, and note the retention period in your records policy.