How it works in a data room
Instead of configuring each file, the administrator sets rights on folders: hidden, view only, download or edit for each group. Subfolders and documents inherit those rights unless an exception is set lower down. That makes the folder tree, normally built from a folder template or the due diligence request list, the backbone of access control. New files dropped into a folder pick up its permissions automatically, which keeps late uploads from slipping through. Numbering from auto-indexing keeps references stable as the tree grows.
Why it matters in a deal
Rooms change daily during diligence. If rights live on individual files, every upload is a chance to forget a setting. Folder rights make the rule obvious: anything placed in the HR folder is visible only to the groups allowed there. They work best when the index is designed with access in mind, separating highly sensitive material into its own folders rather than mixing it into broad categories. File-level exceptions remain useful but should be rare and documented. They are one layer of granular permissions.
Example
A Swiss-owned chemicals business being sold to a trade buyer keeps environmental permits, customer contracts and employee data in separate top-level folders. The buyer’s commercial team sees customer contracts, its environmental consultants see permits only, and employee data is limited to two named lawyers. When a new batch of permits arrives, the seller drops it into the right folder and access is correct without further work. The energy and infrastructure guide shows similar setups.