Alex is Sprintlaw’s co-founder and principal lawyer. Alex previously worked at a top-tier firm as a lawyer specialising in technology and media contracts, and founded a digital agency which he sold in 2015.
Contents
If you’re thinking about buying a business, bringing in an investor, partnering with a supplier, or even selling your own company, one term will keep popping up: due diligence.
Don’t stress - due diligence in business simply means doing structured, thorough checks before you sign anything, so you know exactly what you’re getting (and what risks you’re taking on). Done well, it protects cashflow, avoids nasty surprises, and strengthens your negotiating position.
In this guide, we break down what due diligence is, when you need it, what to look for, and how to run the process under UK law - in a way that’s practical for time‑poor founders and owners.
What Is Due Diligence In Business?
Due diligence in business is a structured review of another company, product, contract, or transaction to confirm facts, assess risks, and validate value before you commit.
Think of it as your pre‑contract safety net. You’re verifying what you’ve been told and spotting issues early - while you can still renegotiate terms, set conditions, or walk away.
In practice, due diligence typically covers financial, legal, commercial, operational, and compliance checks. The scope depends on the deal: buying a company requires deep dives across the board, while onboarding a critical supplier might focus on compliance, financial stability and contract terms.
The goal is simple: make informed decisions and protect your business from avoidable risk. That could mean asking for warranties, changing the price, demanding fixes before completion, or building safeguards into the contract.
When Will A Small Business Need It?
You’ll most often run due diligence when you’re about to:
- Buy a business, brand or asset (share or asset purchase)
- Sell your business (buyers will diligence you; vendors often do “sell‑side” checks first)
- Bring in an investor or new co‑owner
- Take on a major supplier or distributor that’s critical to your operations
- License technology, IP or data that you’ll depend on
- Enter a long‑term joint venture or partnership
- Lease a key site, warehouse or retail unit
For acquisitions, expect a formal process and a secure data room. You’ll likely sign a Non-Disclosure Agreement first, then review documents and ask questions before agreeing final terms in a Share Sale Agreement or Business Sale Agreement.
For partnerships and key suppliers, the scope can be lighter - but don’t skip the basics. A few targeted checks now can save months of disruption later if a counterparty fails to deliver or isn’t compliant.
What To Check: A Practical Due Diligence Checklist
Every deal is different, so tailor your review to what matters most to your business model and the specific transaction. A good way to think about it is by topic area.
Financial And Tax
- 3–5 years of accounts, management reports and cashflow forecasts
- Debtors and creditors ageing - are customers paying on time?
- One‑off items vs recurring revenue; customer concentration risk
- Tax filings and HMRC status (VAT, PAYE, Corporation Tax)
- Loans, security interests, director loans and contingent liabilities
Legal Structure And Contracts
- Company details at Companies House, share capital and any charges
- Key contracts: customers, suppliers, distributors, licensors and lenders
- Unusual clauses: auto‑renewals, exclusivity, termination, change of control
- Standard terms used with customers (B2B/B2C) and any negotiated departures
- Disputes, claims or threatened litigation
If you’re investing alongside existing owners, ensure there’s a robust Shareholders Agreement that covers decision‑making, exits, and dispute resolution.
Commercial And Market
- Customer churn, retention rates and pipeline quality
- Pricing strategy and margin trends
- Competitive landscape and barriers to entry
- Unit economics for core products or services
Operations And Supply Chain
- Critical suppliers and any single‑point dependencies
- Service levels, lead times and logistics contracts
- Facilities, equipment leases and maintenance obligations
- IT systems stability, integrations and licensing
Where premises are key, check lease terms carefully - especially rent review, assignment, subletting and break clauses. If you’re stepping into an existing site, you may need consent or a formal process for Assigning a Lease.
People, Employment And Culture
- Organisation chart, roles and key person dependence
- Employment contracts, salary bands, bonus or commission arrangements
- Policies (disciplinary, grievance, health and safety, whistleblowing)
- Use of contractors and IR35 status risks
- Historic or ongoing HR disputes and tribunal claims
Make sure each staff member has a compliant Employment Contract and that working time, holiday and sick pay practices align with UK employment law.
Regulatory And Compliance
- GDPR and Data Protection Act 2018 compliance for personal data
- Consumer law compliance (Consumer Rights Act 2015 and unfair trading rules)
- Sector licences (for example, alcohol licensing, food safety, FCA regulation)
- Health and safety policies and incident records
- Anti‑money laundering (where applicable), sanctions and bribery controls
If the business collects customer data or runs an online store, check there is a clear, accurate Privacy Policy and appropriate records of consent, retention and data‑sharing.
Intellectual Property And Technology
- Trade marks, domain names and brand assets - ownership and status
- Copyright in content, code, designs and product materials
- IP assignments from founders, employees and contractors
- Third‑party licences (open source, SaaS, APIs) and restrictions
- Cybersecurity, access controls and incident response
If the brand is valuable, consider filing to Register a Trade Mark as part of your value‑protection plan post‑completion.
How To Run Due Diligence Step By Step
1) Define Scope And Priorities
Agree what you need to check and why. Align the scope with your deal goals, price, timeline, and the risks that would be “deal‑breakers” for you. For example, a café purchase might prioritise lease security, hygiene records and staff transfer, whereas a SaaS acquisition will focus on IP ownership, data protection and recurring revenue quality.
2) Put Confidentiality In Place
Before you exchange sensitive information, sign a fit‑for‑purpose Non-Disclosure Agreement. This should cover permitted use of information, who can access it (including advisers), security standards, and what happens on termination or if the deal falls through.
3) Request Documents And Data
Provide a clear request list. Group it by topic (finance, contracts, HR, IP, etc.) and ask for evidence, not just summaries. If something material is “missing” or delayed, treat that as a risk signal and probe further.
4) Review, Verify And Ask Follow‑Up Questions
Read with a risk lens: what could realistically cause loss or disruption for your business after completion? Verify important points - for example, cross‑check a top 10 customer list against actual invoices and bank receipts, and confirm that key contracts don’t have “change of control” clauses that would allow termination when you take over.
5) Quantify Risks And Decide Remedies
Not all risks are equal. Some require a price adjustment, some can be fixed before completion, and others are best handled by warranties, indemnities or conditions precedent in the sale contract. Capture these decisions in a concise risk register so they feed directly into your negotiations.
6) Reflect Findings In The Contract
Use your findings to shape the deal. For share purchases, ensure the Share Sale Agreement includes tailored warranties, disclosure schedules, restrictive covenants and post‑completion obligations. For asset deals, the Business Sale Agreement should clearly list what you’re buying and any excluded liabilities.
7) Plan Integration And First 90 Days
Due diligence is not just a tick‑box exercise - it should help you plan how to integrate people, processes and systems. Capture quick wins and risks to manage in your first 90 days so you protect momentum from day one.
Key Legal Documents, Laws And Red Flags
Here are the legal touchpoints most small businesses encounter during due diligence, and the practical red flags to watch for.
Core Transaction Documents
- Heads of Terms/Term Sheet - sets out key deal points; not always binding, but influences expectations.
- Sale Agreement - a Share Sale Agreement if you’re buying shares, or a Business Sale Agreement for assets.
- Disclosure Letter - where the seller discloses exceptions to warranties; scrutinise carefully.
- Ancillary documents - assignments, consents, board/shareholder approvals, completion deliverables.
If you’re preparing to run a process (sell‑side) or reviewing a target (buy‑side), a structured Legal Due Diligence workstream can keep everything organised and defensible.
Key UK Laws That Commonly Arise
- Companies Act 2006 - governance, filings, directors’ duties, share issuance and transfers.
- Data Protection Act 2018 and UK GDPR - lawful basis, transparency, retention, security and data subject rights.
- Consumer Rights Act 2015 - product/service quality, remedies, fair terms and clear pricing.
- Employment law - Employment Rights Act 1996, Working Time Regulations, National Minimum Wage, and policies and contracts.
- Health and safety law - duty to manage workplace risks and keep appropriate records.
- Sector‑specific laws - for example, licensing (alcohol/food), FCA rules (finance), ASA/CAP (advertising).
You don’t need to become a walking statute book - but your diligence should confirm the target’s compliance posture and highlight any gaps that could turn into fines, claims or operational restrictions.
Common Red Flags (And What They Mean For You)
- Change of control clauses allowing counterparties to terminate on completion - may risk losing a key customer or supplier unless you get consents lined up.
- Missing IP assignments from staff or contractors - without signed assignments, you may not own code, designs or content you’re paying for.
- Auto‑renewing contracts with above‑market pricing - can lock in poor economics unless renegotiated or terminated on time.
- Poor data protection hygiene - no data mapping, outdated notices or weak security controls; potential for regulatory action and customer distrust.
- Undisclosed debts or security interests - check the charges register and bank agreements for covenants and liens over assets.
- Employee issues - missing contracts, misclassified contractors, or unresolved grievances; prepare for remediation and potential liabilities.
- Litigation or complaints - understand exposure, likely outcomes and whether insurance applies.
Not all red flags are deal‑breakers. The value of diligence is turning unknowns into knowns - and then deciding the right remedy: price, contractual protection, pre‑completion fix, or walk‑away.
Get Help: DIY Vs Professional Support
Can you do some due diligence yourself? Absolutely. You know your market better than anyone, and you’ll quickly spot commercial issues, unworkable processes or cultural mismatches.
That said, legal and financial risks often hide in the details: a single clause in a supplier contract, a missing IP assignment, or a subtle tax exposure. It’s wise to combine your commercial insight with specialist support so nothing slips through the cracks.
Typically, a blended approach works best:
- You/your team - market fit, customer interviews, product demos, operations walkthroughs, culture checks.
- Lawyers - contracts, corporate structure, compliance gaps, warranties/indemnities, and drafting the Business Sale Agreement or Share Sale Agreement.
- Accountants - quality of earnings, tax, working capital, and normalised EBITDA.
- Specialists - where needed (for example, property surveys, IT security, environmental, or licensing).
Worried about cost? Scoping upfront keeps things efficient. Focus your professional budget where the biggest legal risks live (usually key contracts, IP ownership, data protection and HR). Avoid generic templates - have critical documents properly drafted and tailored to your deal. For example, if you’ll share sensitive information or code during talks, a strong Non-Disclosure Agreement is essential. And if you’ll run the target with existing owners post‑completion, ensure there’s a clear Shareholders Agreement in place from day one.
Key Takeaways
- Due diligence in business is structured checking before you commit - it turns unknowns into knowns so you can negotiate the right price and protections.
- Tailor your scope to the deal. Focus on financials, contracts, compliance, people, IP and any single‑point dependencies that could disrupt operations.
- Lock down confidentiality early with an NDA, request evidence not just summaries, and verify critical claims against source documents and bank data.
- Use your findings to shape the contract - warranties, indemnities, conditions and price should reflect the real risk profile.
- Watch for common red flags like change‑of‑control clauses, missing IP assignments, weak GDPR compliance and auto‑renewing contracts.
- Blend commercial insight with expert help. Have key documents drafted properly and keep a clear, actionable risk register through to completion and integration.
- Where data and online sales are involved, make sure the target has a compliant Privacy Policy and sound data practices. For brand assets, plan to Register a Trade Mark to protect value.
If you’d like support scoping, running or responding to diligence, or need help preparing your Legal Due Diligence and transaction documents, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no‑obligations chat.
