NDA (Non-Disclosure Agreement)

An NDA (Non-Disclosure Agreement), or confidentiality agreement, is the first document signed in an M&A sale process. It obliges the potential buyer not to disclose or use the business’s information outside the evaluation process. In the Mexican SME segment, the NDA is signed after the teaser — when the buyer expresses interest but before receiving the CIM or any identifiable financial information. Its role is to protect the seller’s identity, customers, suppliers, and financial metrics while the parties assess whether a viable transaction exists.

Why is the NDA the first step in the process?

The NDA is not a formality — it is the gate between public market activity and confidential disclosure. Before the NDA is signed, the seller may only share anonymous information (the teaser). After the NDA is signed, the seller may share the CIM with full financials, customer names, team structure, and deal details.

In Mexican SME M&A, the NDA serves three specific functions:

• Protects the seller’s identity.

  Employees, customers, suppliers, and competitors do not know the business is for sale until the seller chooses to reveal it. A leak before the LOI can damage customer relationships, destabilize key employees, and give competitors information they would not otherwise have.

• Establishes the legal framework for information.

  The NDA defines what is confidential, for how long, and what remedies exist if the buyer breaches. In Mexico, NDAs are enforceable under the Federal Civil Code and the Federal Law for the Protection of Industrial Property.

• Filters serious buyers.

  A buyer who hesitates to sign an NDA is not a serious buyer. The NDA costs the buyer nothing — hesitation signals lack of interest or intent to use the information outside the process.

What must an NDA contain in an SME transaction in Mexico?

Six elements every NDA should define:

• Definition of confidential information: What is covered — financial statements, customer lists, employee information, pricing, trade secrets. The broader the definition, the better for the seller.

• Recipient’s obligations: What the buyer may and may not do with the information. Standard: use only to evaluate the transaction, share only with advisors under the same obligation.

• Exclusions: Information already public, developed independently, or received from a third party without restriction is excluded from the NDA’s scope.

• Term: How long the obligation lasts. In Mexican SME transactions the standard term is 2–3 years from signing, regardless of whether a deal closes.

• No direct contact: A well-drafted NDA includes a provision prohibiting the buyer from contacting the seller’s employees, customers, or suppliers directly without authorization. This is especially important in businesses with high owner dependency.

• Jurisdiction and governing law: Mexican courts under the Federal Civil Code for domestic transactions. If the buyer is from the U.S., jurisdiction is negotiated — sellers prefer federal courts in Mexico City.

Unilateral or bilateral NDA?

In M&A the standard depends on who receives confidential information. Comparison:

The seller’s advisor should reject a bilateral NDA in a sale process: explain that the seller is not receiving confidential information from the buyer but disclosing its own.

What lesson does a real NDA breach case teach?

A specialty food distributor in Guadalajara received interest from a competitor after a teaser was distributed through an advisor. The competitor signed the NDA, received the CIM, and two weeks later began approaching the distributor’s three largest customers directly — claiming to offer better prices and service. The NDA included a no-contact clause covering customers identified in the CIM. The seller’s advisor sent a formal breach notice. The competitor withdrew from the process. The clause did not prevent the harm — two customer conversations had already occurred — but it provided the legal basis for the notice and effectively ended the competitor’s access to the process.

What should the seller verify before signing an NDA?

Four things the seller should verify before signing:

• The definition of confidential information is broad.

  If the definition is narrow or vague, information may leak without a clear breach.

• The term covers the full cycle.

  A 6-month NDA is not enough — due diligence alone can take 3 months, and the information remains sensitive after the process ends.

• It includes a no-contact clause.

  Specifically covering employees, customers, and suppliers identified in the CIM or data room.

• It defines what happens to information if there is no deal.

  The buyer must return or destroy all confidential materials if the process ends without an agreement. This must be a defined obligation with a deadline.

What do buyers and sellers ask about the NDA?

Is the NDA legally binding in Mexico?

Yes. NDAs are enforceable in Mexico under the Federal Civil Code (provisions governing contractual obligations) and the Federal Law for the Protection of Industrial Property for the protection of trade secrets. Enforcement requires proving that the information was confidential, that the obligation existed, and that a breach occurred. In practice, Mexican courts are slow — the main value of the NDA is deterrence and the legal basis for a formal breach notice, not a quick injunction.

How long should the NDA last?

In Mexican SME M&A, 2–3 years from signing is standard. The obligation must survive the end of the process regardless of outcome — a deal that falls apart in due diligence still leaves the buyer with sensitive financial and commercial information that remains confidential.

Can the buyer share the CIM with its advisors?

Yes, within the NDA framework. The buyer may share confidential information with its advisors (lawyers, accountants, financial advisors) provided those advisors are bound by the same confidentiality obligation — either under the original NDA or a separate agreement. The NDA should state this explicitly.

What happens if the buyer breaches the NDA?

The seller may send a formal breach notice and seek damages under Mexican contractual law. In practice, damages are hard to quantify and litigation is slow. The most immediate remedy is to end the buyer’s participation in the process and, if the breach is serious, to seek an injunction to prevent further use of the information. Prevention — through a well-drafted NDA and careful information management — is more effective than enforcement.