How a US sale process uses the room
A typical sell-side process in the United States runs through a banker. The adviser sends a teaser, collects signed NDAs, and opens a first-round room with a confidential information memorandum and a limited set of financials. Indications of interest narrow the field, and the second round opens the full room: contracts, employee data, IP schedules, litigation files and tax returns.
Two features matter more here than in many other markets. First, structured Q&A, because a competitive auction can generate hundreds of questions from several bidders and counsel need to route them by workstream. Second, a clean audit trail, because purchase agreements often define what was “made available” to the buyer by reference to what sat in the data room on a given date. Disclosure schedules lean on that record, so exporting the full index and an archive at signing is standard practice.
Private equity is a large share of US deal flow, which means many rooms serve repeat buyers who expect fast set-up and predictable permissions. Venture rounds and secondary sales use lighter rooms, but the same controls apply once investors see customer or employee data.
Federal review that keeps the room open
Deals above the size-of-transaction threshold need a premerger notification under the Hart-Scott-Rodino Act, filed with both the Federal Trade Commission and the Department of Justice. The threshold is adjusted every year, so check the current figure on the FTC premerger notification page rather than relying on last year’s number.
The HSR waiting period, step by step
If the agencies issue a second request, the parties produce large volumes of documents, and the data room index often becomes the starting point for that production. Cross-border buyers may also face CFIUS review for foreign investment in sensitive businesses. Public targets bring the SEC into the picture through proxy and tender offer rules, and broker-dealers involved in the sale are supervised by FINRA.
| Authority | Where it touches a deal | Room implication |
|---|---|---|
| FTC and DOJ | HSR filing and merger review | Keep the room open until clearance; plan for a second request |
| SEC | Public company targets, tender offers, proxy disclosure | Tight access lists and insider controls |
| FINRA | Broker-dealers advising on the sale | Records of who received what, and when |
| CFIUS | Foreign buyers of sensitive US businesses | Possible limits on foreign viewer access before clearance |
| State attorneys general | State privacy law enforcement | Care with consumer and employee personal data |
Privacy: a patchwork rather than one statute
The United States has no general federal data protection law equivalent to the GDPR. Personal data in a deal room is governed by sector laws (HIPAA for health information, GLBA for financial data) and by a growing list of state privacy acts. California’s CCPA, as amended by the CPRA, is the most developed, and the California Privacy Protection Agency enforces it alongside the state attorney general. Several state acts include exemptions or carve-outs for data shared in a merger or acquisition, but the wording differs from state to state, so counsel should confirm how each applies.
Cross-border note
For transfers in the other direction, EU and UK sellers sharing personal data with US buyers often rely on the EU-US Data Privacy Framework where the recipient is certified. Separately, a Department of Justice rule in force since 2025 restricts some transfers of bulk sensitive US personal data to countries of concern; check whether it affects foreign bidders before opening HR or customer folders.Pricing in dollars
Prices on this site are quoted in USD and are indicative, so confirm them with the provider. Ellty publishes a price from $149/mo with a 14-day free trial; most enterprise rooms such as Datasite, Intralinks and iDeals quote on request, usually based on pages, storage, users or deal length. There is no federal VAT. Some states apply sales tax to software-as-a-service subscriptions and others do not, so the final invoice can differ from the list price depending on where the buyer is based. See VDR pricing for how the common billing models compare.
Indicative room budget in the United States
Pick a billing model, then set the length of the process and the number of users.Deal types you will meet
- Sponsor-backed buyouts and add-ons, often run by the same deal team several times a year. See private equity.
- Banker-led auctions for founder or family-owned companies. See mergers and acquisitions.
- IPOs and follow-on offerings, where underwriters run diligence in a room before the registration statement is filed. See IPO and capital markets.
- Chapter 11 sales under section 363, where the room has to accommodate many bidders on a short timetable. See restructuring and bankruptcy.
For head-to-head detail, Ellty vs Datasite and Datasite vs Intralinks cover the rooms US bankers most often shortlist.
A US deal timeline, stage by stage
The order of events in a US sale is predictable, which makes it easy to plan access and budget. The less predictable part comes after signing, when antitrust review can keep the room busy for weeks or months.
Deal timeline in the United States
- Preparation Index and clean-up Seller and banker build the folder index and decide what to hold back.
- Round one NDAs and the CIM Bidders sign NDAs and see the CIM with summary financials.
- Round two Full diligence A shortlist gets the full room and structured Q&A by workstream.
- Signing Archive the record Index and archive exported to back the disclosure schedules.
- 30-day initial wait HSR review The room stays live; a second request turns it into a production source.
The 30-day initial waiting period applies to most HSR filings (cash tender offers have a shorter one), and it can be extended by a second request. Treat the dates as a planning frame, not a promise.
Data protection obligations at a glance
Without a single federal statute, the obligations in a US room come from several directions at once. The cards below are qualitative on purpose: penalties and deadlines differ by law and by state, so a single headline number would mislead.
Data protection obligations at a glance: United States
Cross-border access options
US law places few general limits on personal data leaving the country, so the questions usually run the other way: can a European seller open its room to a US buyer, and does a foreign bidder trigger any of the newer national security rules?
Cross-border transfer options for a US room
Common mistakes in US rooms
- Treating the waiting period as dead time. Licences, user seats and archive plans lapse while the agencies are still asking questions.
- Uploading the full employee census in round one. Most bidders can value the workforce from aggregated data until the final stage.
- Running Q&A by email. Answers that never reach the room weaken the record of what was “made available” at signing.
- Skipping the signing archive. Disclosure schedules refer to the room, so export the index, Q&A log and documents on the day.
- Assuming one state law. A workforce spread across several states can bring several privacy acts and breach rules into play.
Choosing a provider for a US deal
Many US bankers have a default room, and repeat buyers may know Datasite or Intralinks from earlier deals. Familiarity helps less than it seems, because bidders adapt to a clear interface within a day and the seller pays the bill. Compare the points that change outcomes instead:
- Q&A routing. Can questions be assigned to legal, tax and HR experts, with bidder-level privacy?
- Redaction. Datasite, Intralinks and SmartRoom include it; with Ellty and some others, redact before upload.
- Identity. Corporate sellers with an identity provider may want SSO, which Datasite, Intralinks and iDeals list.
- Pricing model. Ellty publishes a flat monthly price; the others quote per project, often on pages, users or term.
- Archive format. Ask for a sample export before signing the order form.
FAQ
Do I need a US-hosted data room for a US deal?
There is no general federal requirement to host deal documents in the United States. Specific contracts, government work or export-controlled data can impose limits, so ask each provider where files are stored and check any obligations in your own contracts.
Does the CCPA apply to data in a deal room?
It can, if the business meets the CCPA thresholds and the room holds personal information of California residents. The law contains provisions on transfers in a merger or acquisition, but the details are technical, so confirm with counsel.
How long should a US room stay open?
Plan for the full period to closing, including any HSR or CFIUS review, and keep an archive afterwards. Indemnity claims often turn on what the buyer could see in the room.
Are the prices on this page final?
No. They are USD list prices or on-request labels from our research, and they are indicative. Confirm current pricing and any state sales tax with the provider.

