Legal Due Diligence: Process, Checklist, Red Flags, and Data Room Guide

Mergers and acquisitions (M&A) have become increasingly preparation-driven. BCG notes that “beyond antitrust, M&A processes are subject to heightened scrutiny as laws and regulatory frameworks evolve in areas such as data privacy, cybersecurity, and environmental, social, and governance standards.”

Sound legal due diligence in mergers and acquisitions gives buyers a way to test the target’s legal standing before those risks become part of the transaction.

This article explains what legal due diligence is, what it covers, how it works, which red flags to watch for, and how buyers and sellers use virtual data rooms in the process.

Key takeaways

• Legal due diligence is conducted to identify potential risks in corporate, contract, IP, compliance, litigation, employment, real estate, and insurance areas of the business. 
• Buyers use legal due diligence to verify legal standing, liabilities, obligations, and closing risks. The sellers’ role in the process is to prepare clear disclosures and prove the business is transaction-ready.
• Buyers should watch for unresolved approvals, contract consent issues, unclear IP rights, active disputes, liens, or obligations that could affect the purchase price, protections, or closing.
• A virtual data room keeps legal diligence organized. Sellers control access to confidential information, while buyers review documents and conduct Q&A. Both sides preserve a clearer record of the process. 

What is legal due diligence?

Legal due diligence is the review of a company, asset, or person involved in a transaction. It checks legal compliance, existing or potential liabilities, and issues that could affect price, structure, protections, or closing.

M&A due diligence is usually conducted by a law firm for the party that needs protection, most often the acquiring company or investor. In capital markets transactions, lawyers for the issuing company may conduct the review to verify required disclosures.

Why legal due diligence is a must-have

Buyers often inherit more than assets when they acquire or merge with a target. Contract obligations, regulatory exposure, employment claims, litigation, and liabilities tied to past conduct can follow the business after closing.

Bayer’s $63 billion Monsanto acquisition shows the potential scale: years after the deal, Bayer was still facing about 65,000 Roundup claims and pursuing a proposed $7.25 billion settlement.

Conducting legal due diligence enables buyers to identify exposures early, price them appropriately, and negotiate protections. It’s a crucial part of informed decision-making in business transactions.

Key areas of legal due diligence

Legal due diligence covers several areas of the target business, from corporate records and contracts to permits and insurance coverage.

1. Corporate documents & governance

Corporate due diligence confirms that the company is properly formed, validly owned, and managed in line with its constitutional documents and applicable law.

The review typically covers:

• Articles of incorporation and bylaws
• Certificate of incorporation and company registration details
• Shareholder agreements and voting agreements
• Board and shareholder meeting minutes
• Capital structure, share classes, and ownership records

2. Contracts & material agreements

A contract review identifies the obligations, restrictions, and consent requirements that could affect the transaction or the buyer’s ability to operate the acquired business after closing.

The review partially overlaps with commercial due diligence and typically covers:

• Customer contracts and master service agreements
• Supplier contracts, distribution, and agency agreements
• Franchise, licensing, and partnership agreements
• Change-of-control and assignment provisions
• Termination rights, exclusivity terms, and unusual obligations

3. Intellectual property (IP)

Intellectual property due diligence confirms whether the target owns or validly uses the intellectual property that supports its products, services, brand, and technology.

The review typically covers:

• Patent, trademark, copyright, and design registrations
• Trade secrets and proprietary know-how documentation
• IP assignment agreements from employees and contractors
• Inbound and outbound license agreements
• Claims, disputes, or restrictions affecting IP rights

4. Regulatory compliance & permits

Regulatory compliance due diligence assesses whether the target has the approvals required to operate and whether past violations could create liability for the buyer.

The review typically covers:

• Business licenses and operating permits
• Industry-specific regulatory approvals
• Regulatory filings and correspondence
• Records of inspections, notices, or violations
• Compliance policies, procedures, and internal controls

5. Litigation & legal disputes

Litigation review assesses whether current, past, or threatened disputes could create financial, operational, or reputational exposure for the buyer post-transaction.

The review typically covers:

• Pending lawsuits, arbitration, and administrative proceedings
• Past disputes and settlement agreements
• Threatened claims and demand letters
• Court orders, judgments, and enforcement actions
• Legal correspondence with regulators, counterparties, or claimants

6. Employment & labor matters

Employment and labor reviews check whether employee arrangements are legally compliant and whether the transaction could trigger workforce liabilities.

The review typically covers:

• Employee contracts and offer letters
• Employee handbooks and workplace policies
• Compensation, bonus, benefits, and equity plans
• Union agreements and collective bargaining arrangements
• Severance, termination, and redundancy obligations

7. Real estate & physical assets

Real estate and physical asset reviews confirm whether the target has valid title, lease rights, or usage rights over the property and assets needed to run the business.

The review typically covers:

• Property titles, deeds, and ownership schedules
• Lease agreements and licenses to occupy
• Mortgages, liens, charges, and encumbrances
• Asset registers and equipment lease agreements
• Required consents for transferring property or assets

8. Insurance

Insurance due diligence evaluates whether the target has adequate coverage for its risk profile and whether existing insurance policies will remain useful after the deal closes.

The review typically covers:

• Current insurance policies and coverage schedules
• Policy exclusions, deductibles, and coverage limits
• Claims history and unresolved insurance claims
• Risk management assessments and procedures
• Change-of-control effects on insurance arrangements

Most popular data rooms

Overall rating:

The score is calculated as an average, derived from evaluations and the number of reviews on external review platforms.

4.9/5

Excellent

Check price

Overall rating:

The score is calculated as an average, derived from evaluations and the number of reviews on external review platforms.

4.8/5

Excellent

View Profile

Overall rating:

The score is calculated as an average, derived from evaluations and the number of reviews on external review platforms.

4.7/5

Excellent

View Profile

The legal due diligence process: Step by step

Legal due diligence usually begins after the buyer and seller sign a letter of intent (LOI), term sheet, or agree on the key commercial terms of the transaction. At that point, the buyer moves from preliminary evaluation to a structured review of the target’s documents, liabilities, approvals, and closing risks.

Step #1: Define scope, confidentiality, and team roles

Before document review starts, set the rules for what will be reviewed, who can access the information, and who owns each part of the process:

• Confirm whether confidentiality is covered by a separate NDA, the LOI, or both
• Define which legal areas need full review, limited sampling, or specialist input
• Assign a legal lead to manage scope, priorities, Q&A, and risk escalation
• Add specialist advisers where the deal raises issues outside core corporate legal review, such as workforce, tax, or industry-specific regulations
• Set reporting lines so red flags reach the people who can renegotiate terms, request protections, or pause the deal

Step #2: Send the request list and prepare the VDR workflow

After the scope is agreed upon, your counsel should send a legal due diligence checklist (request list) that tells the seller which documents and information to upload to the virtual data room:

• Organize requests by legal category and prioritize documents that can affect valuation, closing conditions, consents, representations, warranties, or indemnities
• Ask the seller to upload documents to the VDR using the same headings and numbering as the request list. Request written answers where documents do not explain the issue clearly
• Confirm that your counsel and approved advisers have the correct VDR permissions. Compare uploaded documents against the request list and flag missing, restricted, outdated, poorly labeled, or inconsistent materials

Step #3: Review documents, verify facts, and manage Q&A

Once the seller uploads documents to the VDR, your legal team should test whether the materials support the seller’s claims and identify which issues matter to the transaction:

• Review priority areas first and verify key facts against source documents, public registry searches, seller responses, and specialist adviser input where needed
• Request clarifications if necessary using the Q&A feature in your data room. Escalate urgent issues while the review is still underway

Step #4: Triage findings and prepare the legal due diligence report

Your counsel should summarize the findings in a decision-ready report:

• Summarize the review scope, documents reviewed, assumptions, limitations, and unresolved information gaps
• Present material findings by legal area and deal impact: price changes, required consents, contract protections, closing conditions, post-close remediation, or potential integration challenges in case of a merger.
• Explain which issues may change the transaction and which can be handled through ordinary post-close remediation.
• Recommend next steps, such as requesting missing documents, revising agreement terms, adding indemnification provisions, creating a holdback, or pausing the deal

Step #5: Negotiate protections and close

Finalize closing deliverables and negotiate purchase agreement protections if necessary:

• Convert material findings into representations, warranties, covenants, indemnities, escrows, holdbacks, or specific closing deliverables
• Require the seller to resolve pre-closing items, such as updating permits, securing corporate approvals, or amending risky contracts
• If legal findings change the target’s risk profile, renegotiate price, structure, or closing conditions
• Move non-closing cleanup items into the post-close integration plan, such as updating internal policies, consolidating legal records, and calendarizing contract renewal dates 
• Pause or walk away if unresolved legal risks cannot be priced, protected, insured, or corrected within the deal timeline

Legal due diligence red flags and buyer responses

Common legal red flags usually fall into a few patterns: missing authority, restricted contracts, unclear rights, unresolved claims, or liabilities that may follow the buyer after closing. 

Managing legal due diligence in a virtual data room

Legal due diligence is usually managed in a virtual data room (VDR). A VDR provides buyers with a controlled platform to review sensitive legal documents, ask questions, track activity, and preserve a record of the process.

Key VDR capabilities that support buyer-side legal diligence include:

• Role-based access permissions: Whether the VDR is seller-administered or run by a repeat acquirer, role-based access helps route documents to the right reviewers by workstream, reducing email-based file sharing and review confusion
• Data security controls: Protections such as IP restrictions, digital rights management (DRM), and data encryption prevent unauthorized file sharing and uncontrolled local copies
• Immutable audit trails: Activity logs help record who accessed, viewed, downloaded, or changed documents, which supports internal records, audits, regulatory filings, and litigation readiness
• Q&A workflow: Centralized Q&A keeps legal follow-ups, seller responses, approvals, and clarifications in one place, reducing the risk of side-channel answers
• Document management and indexing: Structured folders, bulk uploads, and indexed files help your team match seller uploads to the request list and find priority documents faster
• Reporting and insights: Engagement and activity reports help deal leads see which documents have been reviewed, where review is slowing down, and which workstreams need follow-up
• Project archiving: A post-close archive preserves the diligence record, including reviewed documents and activity history, for internal records, disputes, audits, or future integration work
• AI-assisted review: AI search, document chat, summaries, redaction, and translation help teams review contracts faster, spot issues, and work across languages in cross-border deals

Legal due diligence for sellers: how to structure the data room?

In many acquisition and investment processes, the seller or sell-side adviser administers the virtual data room and invites buyer-side reviewers into it.

That often makes data room preparation a seller-side responsibility. To make legal diligence easier for buyers, organize the room before in-depth due diligence begins:

• Use standardized file naming that shows the document type, date, and version where relevant
• Build the folder structure around the buyer’s request list, and mirror the buyer’s workstreams when the request list is organized that way. Add short written explanations where the document set is incomplete or needs context
• Redact sensitive data using built-in VDR redaction tools where available
• Test buyer access before launch using “view as another user” or similar admin features, so external reviewers see the right materials and restricted files stay protected

Platforms such as Ideals give sellers a staging environment to prepare the data room. With billing starting only when the project goes live, sellers can comfortably organize due diligence documents and test access permissions.

Bottom line

Legal due diligence gives deal teams the evidence they need to price risk, negotiate protections, or decide whether to close or walk away. Buyers use it to verify the target’s legal standing, material contracts, compliance records, ownership of key assets, and exposure to disputes or liabilities. Sellers support due diligence investigations by preparing a data room containing complete documents and a Q&A process to keep follow-up organized.