NDAs in Cross-Border M&A
Overview
In the evolving landscape of global mergers and acquisitions (M&A), confidentiality management has become a defining factor of deal success. When transactions span multiple countries, languages, and legal frameworks, even the smallest gap in a Non-Disclosure Agreement (NDA) can lead to major commercial and regulatory risks.
At Arora Global Advisory, we have supported several international clients in safeguarding sensitive business data during high-value acquisitions. This case study explores how a carefully drafted NDA protected a company’s competitive edge in a complex cross-border M&A deal.
Deal Content
An Indian IT services company, TechAxis Solutions Pvt. Ltd., was in advanced acquisition talks with Noventa Technologies GmbH, a European digital transformation firm.
The acquisition aimed to combine TechAxis’s artificial intelligence (AI) expertise with Noventa’s global enterprise client network. However, to proceed with due diligence, TechAxis needed to disclose confidential details — including client data, proprietary software code, and pricing models — to Noventa’s global team spread across multiple EU countries.
The company soon realized that its generic NDA was inadequate for such a high-stakes, multi-jurisdictional transaction.
The Confidentiality Challenge
TechAxis had initially used a standard NDA template, which failed to address the complexities of international data sharing. It lacked clarity on:
Jurisdiction and dispute resolution for international enforcement.
Rules for data access within Noventa’s subsidiaries and affiliates.
The treatment of confidential information after deal termination.
Compliance with global privacy laws such as the GDPR.
As Noventa’s due diligence team began requesting deep access to TechAxis’s algorithms and client projects, management grew concerned that their competitive data could be exposed without sufficient legal protection.
At this critical stage, Arora Global Advisory was brought in to review and strengthen the confidentiality framework.
Legal and Strategic Analysis
Our legal due diligence revealed three core weaknesses in the existing NDA:
Jurisdictional Ambiguity:
The agreement was governed solely by Indian law, creating enforcement challenges in the EU. Any breach overseas would have been difficult to litigate effectively.Undefined Access Rights:
Noventa’s subsidiaries, consultants, and affiliates were not explicitly bound by the NDA, leaving loopholes for internal data sharing beyond the primary contracting entity.Post-Termination Data Risks:
The NDA failed to mandate return or destruction of confidential data if the deal did not close, leaving TechAxis’s proprietary IP exposed even after negotiations ended.
Strategic Resolution
Arora Global’s M&A legal team restructured the NDA to eliminate ambiguity, mitigate cross-border risks, and establish complete legal clarity. This approach reflected best practices drawn from our extensive experience in cross-border M&A advisory work across global jurisdictions.
Step 1: Dual-Law Enforceability
The new NDA was drafted with dual enforceability under Indian and EU laws, and arbitration was set in Singapore — a neutral, internationally recognized venue for cross-border commercial disputes.
Step 2: Entity-Specific Confidentiality Obligations
Each Noventa subsidiary and consultant was explicitly named and bound under the NDA, ensuring accountability and preventing uncontrolled information circulation.
Step 3: Virtual Data Room (VDR) Access Controls
A secure VDR was implemented to host all sensitive data. Access rights were layered by clearance level, and all user activity was logged, watermarked, and monitored for traceability.
Step 4: Post-Deal Data Protection
Clauses were added to mandate complete data return or certified destruction within a fixed time frame if the acquisition did not close, with penalties for non-compliance.
Step 5: Global Compliance Alignment
The NDA incorporated GDPR provisions and Indian IT Act requirements to ensure seamless cross-border data protection and privacy compliance.
Outcome
The restructured NDA provided both parties with confidence and legal assurance to proceed. Due diligence resumed under strict controls, and the acquisition was finalized within five months without a single confidentiality incident.
TechAxis retained full control of its intellectual property, while Noventa gained structured access to the data necessary for its evaluation — proving that a well-drafted NDA can enable collaboration without compromising security