Best Data Room for Due Diligence in New Zealand (2026)

Picture a mid-sized Marlborough winery near Blenheim. Eighteen permanent staff, forty hectares of Sauvignon Blanc, a decade of export orders, a recognisable label on shelves in three countries.

The founders have signed a term sheet with an Australian drinks group. The offer is conditional on due diligence.

A Wellington law firm acting for the buyer has just emailed a sixteen-page request list. From that moment to the day funds clear, the sale becomes a disciplined exercise in disclosure.

How tightly the sellers run it decides three things:

• whether the headline price holds,
• whether the warranties stay narrow,
• whether an offshore buyer clears its regulatory hurdles before the vintage turns.

This guide follows that winery through the diligence lifecycle, and shows where a virtual data room does the quiet, load-bearing work.

What is a buyer really trying to prove in diligence?

Diligence is the buyer confirming the business is exactly what the term sheet assumed. Nothing about the headline price is safe until they are satisfied.

Having agreed a number in principle, the Australian buyer now sets out to prove that:

• the revenue is real and repeatable,
• the export contracts survive a change of ownership,
• the vineyard land and water rights are genuinely owned or securely held,
• the eighteen staff are lawfully employed,
• no tax, biosecurity or environmental liability is waiting to surface after settlement.

Each is a question the seller answers with documents, not assurances.

For the Blenheim founders that means opening up:

• years of financial statements,
• every material grape-supply and distribution agreement,
• employment and seasonal-labour records,
• resource and water consents on the vineyard blocks,
• the full brand and varietal position behind the label.

It is a large, sensitive pile, much of it holding personal information about staff and customers. That is precisely why an open shared link is the wrong instrument and a permissioned room is the right one.

Which stage of the diligence lifecycle are you in?

Diligence is a sequence of distinct phases, not a single event. Each one leans on the room in a different way.

A mid-market New Zealand sale like the winery typically runs four to eight weeks from request list to completion. A cross-border or heavily consented deal can run considerably longer.

Knowing which phase you are in tells you what the room should be doing for you. The timeline below lays out the whole arc.

The opening phase: scoping and first disclosure

Early on, the work is architectural, not combative. The sellers:

• read the request list,
• push back on anything framed for a listed corporate rather than an eighteen-person winery,
• build a folder index that mirrors what remains.

Then they load a clean first tranche: corporate records, three years of accounts, the headline contracts.

The room’s job here is to keep that opening set tidy and view-only, so the buyer’s advisers form an early impression of a well-run business.

The investigation phase: staged release and questions

The middle weeks are where the deal generates heat. Sensitive tranches open as trust and exclusivity firm up, reviewers work through the detail, and questions start to flow.

The room now earns its keep through granular permissions and a structured question log. Answers stay attached to the documents that prompted them, and the sellers keep control of what opens when.

The confirmatory phase: findings and completion

By the closing weeks the buyer’s findings feed into a final conversation about price and warranties. The room’s audit trail becomes the reference point for what was actually shown.

The last act is to freeze and export the room as it stood at completion, producing an archive both sides retain. That record is the definitive answer to any later dispute about disclosure.

Who writes the request list, and how much applies to a winery?

The request list is unmistakably the buyer’s document. Control of the room that answers it belongs firmly to the seller.

The buyer’s lawyers and accountants draft the list against a standard New Zealand diligence checklist, covering corporate, financial, commercial, employment, property, IP, tax, litigation and regulatory categories. It arrives long, generic and partly irrelevant.

Part of the founders’ job is to trim it. A family winery does not need to answer requests written for an entity with offshore subsidiaries or listed-company reporting obligations.

What the sellers own outright is the architecture of the response:

• the folder structure,
• the order in which categories open,
• which reviewers on the buyer’s side see which tranche.

Mirror the request list in the room’s index and an intimidating document becomes a visible map. Every requested item maps to a folder, and any gap becomes obvious to the seller’s own team first.

Getting that architecture right is the single biggest lever on how the following weeks feel. It is worth reading alongside our M&A guide if the diligence sits inside a full company sale.

How do you turn the list into a room the buyer can navigate?

Populating the room is where diligence quietly succeeds or fails. A reviewer who cannot find a document raises it as a question, and every avoidable question is a day of delay and a small dent in confidence.

The temptation is to bulk-upload everything and let the buyer dig. The discipline is a numbered index that answers the request list category by category, so the room reads like a well-run business rather than a filing cabinet tipped onto a screen.

Our guide to what documents go in a data room sets out those categories in full.

The winery’s build follows a repeatable order, and the same sequence works for almost any New Zealand seller. It is deliberately dull, because dull is what a buyer’s counsel wants to see.

Build the room in five moves

Mirror the buyer's list, then control the order of release. The aim is a room a reviewer can navigate without asking you where anything is.

1. 1

   Number the folders to the list

   Create one top-level folder per request category and number it to match the buyer's list, so an empty folder is a visible gap you close before anyone logs in.

2. 2

   Bulk upload, then check versions

   Load documents in bulk, then confirm only the executed, current copy of each contract is live and every superseded draft is archived out of sight.

3. 3

   Redact what the law or sense requires

   Mask bank details, individual salary lines beyond what the buyer needs, and third-party personal information that is not material to the deal.

4. 4

   Set everything to view-only

   Default the room to view-only with watermarked downloads, so nothing sensitive leaves the room as a loose, untraceable file.

5. 5

   Hold the sensitive tranche back

   Keep key customer contracts, the IP files and detailed payroll behind permissions you release only once exclusivity is confirmed.

Where does each requested document actually live?

Most sellers overestimate how much of the request list they must create, and underestimate how much they already hold.

Map each buyer request to its real-world source and an intimidating list becomes a set of retrieval tasks. It also flags which items belong in the opening tranche and which should wait.

The table below breaks the winery’s material down the way the founders and their adviser worked through it.

How the winery's request list maps to real sources, and when each category sensibly opens.

Buyer request	Where it lives in the business	When to release
Share register, constitution, minute book	Companies Office filings and the company's own records	Opening
Three years of accounts and management reports	The accounting system and the external accountant	Opening
Grape-supply and distribution agreements	Contract files held by management or counsel	Staged
Export eligibility and distributor contracts	Sales files, MPI wine records, distributor terms	Staged
Vineyard titles, leases and water consents	LINZ titles and regional council consent records	Opening
Wine brand, labels and varietal rights	IPONZ registrations and internal brand files	Staged
Employment and seasonal-labour records	HR and payroll systems, individual staff files	Staged
GST, excise and IRD correspondence	IRD filings and the accountant's tax workpapers	Opening

Two things fall out of this.

First, a good chunk of the record is publicly verifiable: the Companies Office filings, the LINZ titles, the IPONZ registrations. The buyer’s lawyers will cross-check it against the public registers regardless of what you upload, and any mismatch reads as sloppiness at best.

Second, the deal-shaping, sensitive material is concentrated in the commercial, employment and IP rows. That is exactly what belongs in a staged, permissioned tranche rather than the opening disclosure.

What changes when the buyer is offshore?

An overseas buyer can add an entire regulatory workstream a domestic sale never touches. On a rural land holding it is the first thing to check, not the last.

The Blenheim buyer is an Australian company, and the target includes forty hectares of vineyard. So the deal runs into the Overseas Investment Act 2005.

An overseas person acquiring sensitive New Zealand land, which generally includes non-urban rural land over five hectares, needs consent from the Overseas Investment Office before the acquisition completes.

That consent is not a rubber stamp. It carries its own information demands, its own conditions and, crucially, its own timeline, which can extend the deal by months.

For the seller, the practical effect is a parallel diligence stream that also runs through the room.

The sellers add a consent-conditions folder. The buyer’s advisers use the room to assemble what the Overseas Investment Office will want, drawing on the same titles, consents and financial records already loaded for the trade diligence.

The governing rules sit in the Overseas Investment Act 2005. Any seller to an offshore buyer should have counsel confirm early whether consent is required, because discovering it in week six rather than week one is how a clean deal loses a season.

The upside of a well-built room: it feeds both processes at once, instead of forcing the sellers to assemble the same evidence twice.

How do you run Q&A without losing the thread?

Once reviewers are inside, questions arrive steadily. On a deal this size, sixty to eighty across the categories is unremarkable.

Run that over email and the process fractures within a fortnight:

• questions get answered twice,
• an outdated answer reaches the buyer,
• nobody can reconstruct who said what when the warranty schedule is negotiated weeks later.

A structured question module fixes this. Each item becomes a tracked request that routes to the right owner:

• the accountant fields the tax and excise questions,
• the vineyard manager handles water consents and biosecurity,
• every answer stays attached to the document that prompted it.

The quieter benefit is evidentiary. When the buyer’s lawyers later assert something was never disclosed, the question log and audit trail together show exactly what was said and shown.

Experienced New Zealand advisers treat that log as part of the disclosure itself, not an administrative convenience.

Which red flags quietly stall New Zealand diligence?

Most deals that slow down do so for a small, recurring set of reasons. Nearly all are preventable at setup, not mid-flight.

The failures cluster around two things:

• a room that fights the reviewer instead of guiding them,
• disclosure that does not survive an independent check.

The six below turn a six-week process into a twelve-week one, each paired with the fix that removes it.

The pattern underneath all six is the same. Disorganised, over-broad or unverifiable disclosure erodes trust, and eroded trust is paid for in wider warranties and a slower close.

The winery cleared these before anyone logged in, which is why its investigation phase stayed inside three weeks.

A seller who leaves two or three unaddressed should expect the opposite, and should expect the buyer’s counsel to price the disorder into the deal.

What are your Privacy Act duties while the room is open?

Disclosure during a deal does not suspend your privacy obligations. It concentrates them.

The winery holds personal information about eighteen permanent staff, a roster of seasonal workers and its trade customers. Under the Privacy Act 2020, the sellers stay accountable for how that information is handled, even while it is shown to a buyer.

A room is what makes that accountability practical rather than aspirational. The matrix below shows why a shared folder or an email thread cannot discharge the same duties.

Which privacy safeguards each tool can actually deliver during a live deal.

Safeguard for personal information	Shared folder or email	Purpose-built data room
Limit who can see each file	✗	✓
Watermark downloads to deter leaks	✗	✓
Revoke access the moment a party drops out	✗	✓
Log every view of personal data	✗	✓
Produce evidence of the safeguards afterwards	✗	✓

Collect and disclose only what is material

The first duty is restraint. Not every reviewer needs full payroll detail or a complete customer list.

Disclosing personal information more widely than the deal requires is both a Privacy Act risk and a negotiating own-goal. The sellers redact individual salary lines to what the buyer genuinely needs, and gate the rest behind confirmed exclusivity.

Keep the record that proves you took care

The second duty is evidential. The Act expects reasonable security safeguards over the personal information you hold, and the room’s exportable log is your proof that access was limited, watermarked and revocable.

The Office of the Privacy Commissioner treats that kind of access control and logging as a basic expectation, not a premium. The log you keep is the record you produce if anyone ever asks how staff and customer data was handled.

What should a diligence room cost, in NZD?

Pricing tracks your role and deal size far more than any published rate card. Treat the figures below as indicative, and confirm a written quote before you sign.

As a rule:

• a short, defined process favours per-deal pricing,
• advisers running diligence repeatedly are better off on a flat annual plan that opens unlimited rooms.

The winery sits squarely in the single-deal band. It needs one well-run room for roughly two months, not a platform sized for a bank.

Indicative NZD data room pricing by role. Confirm the current quote with each provider.

Your role	Indicative NZD/mo	Pricing model	Notes
Founder testing the waters	Free trial, then from ~$150	Flat monthly	Enough for a single room before you commit budget
Single-deal seller	~$400 to $900	Per-deal or short flat term	Sized to one process, close to the winery profile
Adviser or law firm	~$800 to $2,000	Flat annual, unlimited rooms	Best value running several diligences a year
Cross-border or high-volume M&A	$2,500+	Per-deal, negotiated	Deep permissioning, large volumes, dedicated support

A single-transaction mid-market sale like this one usually lands in the second band. The honest advice: open a room and test the workflow before you pay for a year of anything.

A 14-day free trial is made for exactly that. Load a first tranche and see whether the permissions and question log suit your deal before committing.

See our full pricing breakdown for how per-page, per-user and flat-rate models compare, then confirm the live number with each vendor before you sign.

How does disclosure shape the warranties you give?

What you disclose is not just information for the buyer. It is the boundary of the warranties you will end up giving.

As the buyer’s findings feed the final negotiation, the disclosure record becomes the reference point for the warranty schedule. A buyer who was demonstrably shown a problem cannot later claim ignorance of it.

For the winery sellers, a complete, well-organised audit trail is worth real money. Every disclosed issue is one the buyer was on notice of, which narrows the warranties the founders give and shrinks what a buyer can argue about after settlement.

A clean disclosure record does not just defend the deal after it closes. It shapes the warranties before it closes, because what the buyer was shown is what they can no longer claim they never saw.

That is why sellers who treat the room as an afterthought tend to give broader warranties than they needed to. Disorganised disclosure leaves genuine doubt about what was shown, and a cautious buyer prices that doubt into the indemnities.

A room that logs every view and keeps answers attached to source documents removes the ambiguity. The founders trade a tidy record for a tighter warranty position, one of the least visible but most valuable returns the room delivers.

What happens to the room once the deal closes?

Completion is not the moment the room goes dark. It is the moment it freezes into evidence.

Standard practice is to freeze and export the room exactly as it stood at completion, producing a single archive both sides retain. Only once that archive is secured, and departing reviewers have lost access, should the live room be wound down.

That export is far more than housekeeping. It is the definitive answer to any future dispute about what was disclosed, and it doubles as evidence of Privacy Act 2020 compliance by showing who accessed which personal information and when.

For the winery, the archive closes the loop the whole process opened. The request list came in, the room answered it in order, the questions were logged, and now the completed record protects both sides against the version of events memory alone would never settle.

If your diligence was part of raising capital rather than a trade sale, our fundraising guide is the closer fit.

So how do you know diligence is genuinely done?

Diligence is finished not when the last document loads, but when the buyer has nothing left to verify and the disclosure record can stand on its own.

For the Blenheim founders, that point arrives when:

• the request list is fully answered,
• the question log shows no open items,
• the overseas-investment consent condition is satisfied,
• the room can be exported as a coherent record of everything shown.

Everything in this guide bends toward that moment:

• the mirrored index that surfaced gaps early,
• the staged release that protected sensitive data,
• the tracked questions that kept answers in context,
• the audit trail that now narrows the warranties and evidences the privacy safeguards.

Get the setup right and the rest is momentum. Get it wrong and the same deal spends its extra weeks in avoidable questions and widening warranties.

A well-run room is the difference between the two. On a deal the size of a winery, that difference is measured in both the price that holds and the season that does not slip.

Common questions from first-time New Zealand sellers

How long does due diligence take in New Zealand?

For a mid-market deal like an eighteen-person winery, expect roughly four to eight weeks from request list to completion, assuming a well-organised room and prompt answers. Complex, regulated or cross-border transactions run longer, and an overseas-investment consent can add months. The biggest accelerant is preparation: a room that mirrors the request list with clean version control cuts the question backlog that otherwise stretches the timeline. Our guide on how long due diligence takes works through the variables.

Who pays for the data room in a sale process?

Almost always the seller, because the seller is the party disclosing and therefore the one who needs the control, watermarking and audit trail. For a one-off transaction, per-deal pricing usually works out cheaper than an annual plan; an adviser running several sales a year is better on a flat annual room that opens unlimited deals.

Does an overseas buyer always need Overseas Investment Office consent?

Not always, but often on land-based deals. An overseas person acquiring sensitive New Zealand land, which generally includes non-urban rural land over five hectares such as a vineyard, needs consent before completion, and significant business assets can trigger a separate test. Have counsel confirm the position early, because discovering it late reshapes the whole timeline.

How does a data room help with the Privacy Act 2020?

The Act keeps you accountable for personal information you hold, including staff, seasonal-worker and customer data disclosed during a deal. A room helps by limiting who can see that information, watermarking anything downloaded, letting you revoke access instantly, and logging every interaction. The exportable log is your evidence that you handled personal information responsibly.

Can I stage disclosure so buyers do not see everything at once?

Yes, and in New Zealand practice you usually should. Granular per-file and per-folder permissions let you open a clean first tranche to keep momentum, then release sensitive customer contracts, IP and payroll only once exclusivity is confirmed. That staging is trivial in a proper room and a manual chore on a shared drive.

Do I need ISO 27001 or SOC 2 certification for a diligence room?

Not strictly, but independent assurance such as ISO 27001 or SOC 2 lets a buyer's counsel clear the platform quickly, and for sensitive or regulated deals it is effectively expected. For a small early-stage raise, strong encryption, granular permissions and audit logging may be enough. Check what your counterparties require before you choose.

Keep reading

• DiligenceThe New Zealand due diligence checklistEvery category a buyer's request list covers, and what sits behind each one.Read guide
• DiligenceHow long does due diligence take in New Zealand?Realistic timeframes and the factors that stretch a deal past them.Read guide
• SetupWhat documents go in a data roomThe full category list behind a numbered index a reviewer can navigate.Read guide
• Use caseData rooms for mergers and acquisitionsHow diligence fits inside a full company sale, from term sheet to completion.Read guide
• Use caseData rooms for startup fundraisingWhen the diligence sits inside a capital raise rather than a trade sale.Read guide