Australia punches above its weight in deal activity. Superannuation funds, global private equity and Asian strategic buyers all compete for Australian assets, so a typical room serves bidders in Sydney, Singapore, London and New York at once. Two vendors on this shortlist, Ellty and Ansarada, are headquartered in Australia; the others are global platforms that Australian advisers meet on cross-border deals.
Map the approvals
Check whether the deal needs ACCC notification, FIRB approval for a foreign buyer, or both. Each can extend the timetable and keep the room open longer.
Sort personal information
Identify employee, customer and tenant records, and decide which can be de-identified for the first round.
Contract for overseas access
If offshore bidders will see personal information, put APP 8 terms into the confidentiality agreement before they get access.
Build permissions by round
Open summary material first, then expand access group by group as the field narrows.
Archive at completion
Export the index, Q&A log and audit trail so warranty claims can be checked against what was disclosed.
The Privacy Act and cross-border disclosure
The Privacy Act 1988 and its thirteen Australian Privacy Principles cover most businesses with annual turnover above AUD 3 million, along with some smaller ones such as health service providers. The Privacy and Other Legislation Amendment Act 2024 added a statutory tort for serious invasions of privacy and stronger enforcement powers, and further reforms have been flagged, so check the current position before relying on older advice.
APP 8 deals with disclosing personal information to someone overseas. Its trigger is access, not storage location: if a bidder in Hong Kong can open a payroll file, that is a disclosure. The OAIC’s APP 8 guidelines explain the “reasonable steps” expected, which in practice means contractual terms with the recipient.
Does APP 8 apply to your data room?
Accountability stays with you
Under section 16C, if an overseas recipient mishandles information you disclosed, your organization can generally be treated as if it had breached the APPs itself, unless an exception applies. That is a strong reason to keep personal data out of the room until it is truly needed.Regulators that set the pace
| Body | Role in a transaction | Effect on the room |
|---|---|---|
| ACCC | Merger control; notification is mandatory for deals above thresholds from 1 January 2026 | Room stays open through the review period |
| FIRB and Treasury | Foreign investment approval | Foreign bidders may need approval before completion |
| ASIC | Corporations law, disclosure and takeover conduct | Controlled access for listed targets |
| ASX | Continuous disclosure for listed entities | Leak risk makes audit trails essential |
| Takeovers Panel | Resolves takeover disputes | Equal access to information can be contested |
The ACCC’s merger guidance sets out the new regime, including thresholds and timelines. Because the mandatory system is recent, expect guidance and practice to keep developing.
Public M&A in Australia often runs as a scheme of arrangement approved by shareholders and the court rather than a takeover bid. Schemes usually involve a period of exclusive due diligence after a non-binding indicative offer, which is when the full room opens to one party.
Price and tax in Australian dollars
Vendors here generally bill in USD; our figures are indicative, so confirm with the provider. Ellty publishes $149/mo with a 14-day free trial, while Ansarada, iDeals and Datasite quote on request. GST at 10% may apply to digital services bought from overseas suppliers. Registered businesses buying for business purposes are often outside the offshore supplier rules, but the treatment depends on your registration status, so confirm with your accountant. Budget a margin for currency movements on long processes; the VDR pricing guide explains billing models.
Indicative room budget in Australia
Pick a billing model, then set the length of the process and the number of users.Where Australian deals concentrate
Mining and energy assets, infrastructure sold to super funds, healthcare and life sciences, and technology businesses acquired by US and Asian strategics make up much of the market. Related guides: energy and infrastructure, private equity, life sciences and biotech and mergers and acquisitions. For the two Australian-headquartered vendors’ strongest global rivals, see Ellty vs iDeals and Firmex vs Ansarada.
Deal timeline for an Australian scheme
Public deals in Australia often run as schemes of arrangement, and the shape of a scheme decides when the room opens and to whom. Private sales follow a more familiar auction, but the approval stage at the end is the same.
Deal timeline for an Australian scheme of arrangement
- Approach Indicative offer A non-binding indicative offer, often for a listed target.
- Exclusivity Due diligence The full room opens to one party for a set period.
- Signing Implementation deed Announced to the ASX; the disclosure record is archived.
- Approvals ACCC and FIRB Mandatory ACCC notification above thresholds; FIRB for foreign buyers.
- Completion Court and shareholders Two court hearings and a scheme meeting before implementation.
Data protection obligations at a glance
The 2022 penalty increases and the 2024 amendments have made the Privacy Act a much sharper instrument than it was a few years ago.
Data protection obligations at a glance: Australia
Cross-border disclosure options
Cross-border disclosure options for an Australian room
Common mistakes in Australian rooms
- Assuming the small business exemption applies. Turnover is not the only test, and some smaller businesses are covered regardless.
- Planning around the old voluntary ACCC practice. Deals caught by the mandatory regime cannot complete before clearance.
- Letting offshore advisers in before APP 8 terms are signed. The disclosure happens on first view, not at signing.
- Opening everything at once during exclusivity. One bidder does not remove the need to stage personal information.
- Ignoring GST registration in the budget. Whether GST appears on the invoice depends on your status and the supplier’s.
Choosing a provider for an Australian deal
Two providers on this shortlist, Ellty and Ansarada, are headquartered in Australia, which can make billing and support conversations simpler, though you should still ask about support cover in London and New York hours when bidders sit there. Ansarada is a long-standing name in Australian advisory work and lists ISO 27001 and SSO. Ellty pairs the full deal toolkit with e-signature, AI tools and a published price. iDeals and Datasite add SSO and built-in redaction for larger cross-border processes. For schemes, check how easily a single bidder’s access can be expanded in stages, and how the full archive is delivered at implementation.
FAQ
Does an Australian data room have to be hosted in Australia?
The Privacy Act does not require local hosting. APP 8 focuses on disclosure to overseas recipients, which includes bidders viewing files from abroad. Government and some regulated sectors may impose their own residency terms.
Does APP 8 apply to small businesses?
Most businesses with turnover of AUD 3 million or less are exempt from the Privacy Act, though there are exceptions. Check whether the target or seller is covered before relying on the exemption.
When must a deal be notified to the ACCC?
From 1 January 2026, acquisitions that meet the monetary and other thresholds must be notified and cannot complete before clearance. Thresholds and exemptions are technical, so take advice.
Is GST added to a data room subscription?
It may be, depending on the supplier's GST registration and whether you buy as a registered business. Confirm the position with your accountant and the provider.
