ACQUIREMANWhat is due diligence?
Due diligence is the buyer’s detailed review of a business before committing to buy it or invest in it. It tests whether what the seller has said is true, finds risks that affect price or structure, and gives the buyer what it needs to draft warranties and indemnities.
For sellers, the best strategy is simple: do your own diligence first. Fix what you can, explain what you cannot, and organise everything in a data room before the buyer asks.
How to organise your data room
Use one folder per area below, a numbering system (1.1, 1.2…), and an index. Name files clearly, add dates, and keep a log of what has been shared and when. Share sensitive items (customer-level data, source code, employee personal data) only after a letter of intent, and in redacted form where possible.
1. Corporate and legal
- Certificate of incorporation, MOA and AOA, and all amendments
- Up-to-date cap table, share certificates or demat records, register of members
- Shareholders’ agreements, investment agreements, SAFEs/iSAFEs, CCPS and CCD terms
- ESOP scheme, grant letters and vesting schedules
- Board and shareholder minutes and resolutions (last three years)
- ROC filings and statutory registers
- Subsidiaries, branches and group structure chart
- Pending or threatened litigation, notices and regulatory correspondence
2. Financial
- Audited financial statements (last three years) and current-year management accounts
- Monthly revenue by customer, product and geography
- Recurring vs one-off revenue split; ARR, churn and retention reports
- Budget and forecast with assumptions
- Debt, guarantees, charges and off-balance-sheet liabilities
- Working-capital analysis, receivables ageing and bad debts
- Related-party transactions
3. Tax
- Income-tax returns and assessments, with any open demands or disputes
- GST registrations, returns and reconciliations
- TDS compliance and returns
- Transfer-pricing documentation (if cross-border group transactions exist)
- Valuation reports for past share issues and transfers
- Tax holidays, incentives or Startup India / DPIIT recognition certificates
4. Intellectual property
- Trademarks, patents, designs and domain names — registrations and applications
- IP assignment agreements from every founder, employee and contractor who contributed to the product
- Licences in and out (including third-party software and data licences)
- Open-source software inventory and licence compliance (especially copyleft licences)
- Any IP disputes or infringement claims
5. Technology and security
- Architecture overview, technology stack and hosting arrangements
- Source-code access (usually via a clean-room review or escrow at a later stage)
- Security policies, penetration-test reports and incident history
- Uptime, disaster recovery and backup arrangements
- Key vendors and their contracts (cloud, payments, APIs)
- For AI products: models used, dependencies on model providers, training-data sources and rights, evaluation and guardrail processes
6. Data protection and privacy
- Privacy policy, cookie notice and consent records
- Data inventory: what personal data you hold, where, and why
- Data-processing agreements with vendors
- Cross-border data-transfer arrangements
- Breach log and how incidents were handled
- Readiness for India’s Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 — and the GDPR if you serve EU customers
7. Commercial
- Top customer contracts, including terms on renewal, termination, pricing, exclusivity and change of control
- Customer concentration analysis
- Key supplier and partner contracts
- Sales pipeline and win/loss data
- Pricing and discounting policy
8. People and HR
- Organisation chart and headcount by function and location
- Employment contracts, offer letters and consultant agreements
- Compensation, bonus and ESOP details for key employees
- PF, ESI, gratuity and professional-tax compliance
- POSH policy and committee records
- Non-compete, non-solicit and confidentiality obligations
- Attrition data and pending employee claims
9. Regulatory and licences
- Business licences and registrations (e.g., Shops and Establishments, IEC)
- Sector-specific approvals (for fintech, health-tech, ed-tech and similar)
- FEMA filings for any foreign investment (FC-GPR, FC-TRS) and annual returns
- Anti-bribery and sanctions compliance
Red flags buyers look for
| Red flag | Why it matters | How it is usually handled |
|---|---|---|
| Missing IP assignments | Company may not own its own product | Fix before closing; specific indemnity |
| Unreconciled cap table | Uncertainty about who owns what | Rectification; condition precedent |
| Customer contracts with change-of-control clauses | Key customers could leave after the deal | Customer consents before closing |
| Past FEMA non-compliance | Penalties and compounding required | Compounding before closing; indemnity |
| Undisclosed tax demands | Hidden liabilities | Escrow or specific indemnity |
| Open-source licence conflicts | Code may need to be rewritten or released | Remediation plan; price adjustment |
How long does due diligence take?
Usually four to twelve weeks. Simple, well-prepared deals can be quicker; regulated businesses, cross-border buyers or messy records take longer.
Next steps
Use this checklist to prepare months before you sell — our exit readiness guide explains how. For a quick gap analysis, generate a free M&A readiness report with Acquireman AI, including a tailored data-room checklist.
Frequently asked questions
What is included in an M&A due diligence checklist?
Corporate and legal records, financial statements, tax filings, intellectual property, technology and security, data protection, commercial contracts, HR and employment, and regulatory licences.
How long does due diligence take?
Typically four to twelve weeks. Preparation by the seller, the size of the business and regulatory issues are the main factors.
What do buyers focus on in tech due diligence?
IP ownership and assignments, open-source licence compliance, architecture and scalability, security and incident history, dependencies on third-party providers, and — for AI companies — model dependencies and training-data rights.
What happens if due diligence finds a problem?
Most issues are resolved by fixing them before closing, adjusting the price, adding a specific indemnity, holding part of the price in escrow, or making the fix a condition of closing. Only serious issues usually end a deal.
This article is general information for educational purposes, current as of 11 October 2026. It is not legal, tax, financial or investment advice. Laws, regulations and market conditions change — consult qualified professionals before acting. Acquireman is a marketplace and advisory platform; see our Terms of Use.