Selling your business is a major milestone, and whether you’re cashing in after years of hard work or simply moving on to the next chapter, one thing is certain: buyers don’t like surprises. Especially not the kind that involves missing paperwork, outdated policies, or non-compliance with data protection laws. Yet, time and again, small businesses head into sale discussions woefully underprepared on the documentation front.
As a solicitor advising on business sales, I’ve seen first-hand how missing documents can delay a deal, reduce the price, or even lead to awkward indemnity negotiations. So, let me walk you through the most common gaps and what to do about them.
Why Documentation Matters
Buyers who look to acquire your business will carry out due diligence. This is a comprehensive investigation into your company affairs based on an information request list that can run into dozens of pages (see more info here). Every area of your business will be under the microscope, from corporate records to employment contracts, from financial statements to data protection compliance. A buyer will usually use a detailed legal, due diligence questionnaire.
Where documents are missing or unclear, the buyer has two main options: walk away because the risk is too big or ask for protection in the form of warranties and indemnities.
What’s an indemnity?
In simple terms, an indemnity is a promise by the seller to reimburse the buyer if a specific liability arises in the future, on a so-called pound-for-pound basis. It differs from a warranty (which is more of a statement of fact) because it creates a direct financial obligation if something goes wrong. If you’ve failed to comply with data protection law and are later fined, the buyer may claim under the indemnity to recover their loss.
So, if you’re thinking, “Do I really need to tidy up that dusty GDPR policy?” the answer is yes – because if you don’t, you may end up footing the bill later.
The Most Commonly Missing Documents
Having reviewed countless due diligence questionnaires like the one linked above, I can confidently say that certain documents are almost always missing or incomplete in many small businesses. Here are the key culprits:
1. Data Protection Documentation
This is one of the most consistently overlooked areas in small business sales. Under UK GDPR and the Data Protection Act 2018, businesses must be able to demonstrate compliance – and not just by saying so.
You’re expected to have:
- A current privacy policy (both internal and external)
- A completed data mapping exercise and DPIA
- A record of processing activities (especially if you handle special category data)
- Consent records, where applicable
- A data breach response plan
- A Subject Access Request (SAR) procedure
- Processor agreements with any third party handling personal data on your behalf
- Evidence of staff training and policies on data handling
Yet, in many cases, these simply don’t exist, or the policies are lifted from a template and never reviewed – lots of small businesses have a “GDPR policy” or “privacy policy”, and that’s all. And it’s not enough.
Buyers will almost certainly flag this. Where the documentation is missing, you’ll likely be asked for an indemnity covering any regulatory investigations, fines or claims. Worse, if you’ve had a data breach and not notified the ICO, that could become a deal-breaker.
2. Employee Contracts and Policies
Many small businesses rely on informal arrangements, particularly with long-standing staff. But that won’t cut it for a buyer. You’ll need:
- Signed contracts for every employee and consultant
- A current staff handbook with up to date policies
- Evidence of compliance with holiday pay, working hours, and statutory rights
- IR35 assessments where off-payroll workers are used
- Confirmation of right-to-work checks and any sponsorship licences
Missing these opens you up to employment claims post-sale. Again, indemnities may be requested.
3. Corporate Records and Shareholder Agreements
You’d be surprised how many companies can’t lay their hands on their statutory registers. Buyers will expect:
- A complete set of statutory books (including PSC register)
- Shareholder agreements and historic resolutions
- Any powers of attorney
- A clear shareholding structure
Gaps here create legal uncertainty – and when shares are being sold, that can affect completion. The buyer may also demand indemnities against unknown third-party claims to ownership.
4. Contracts with Customers and Suppliers
Ideally, your key relationships should be governed by clear, written terms. But in practice, many small businesses operate on email chains and goodwill.
You should aim to have:
- Standard terms and conditions for sales and purchases
- Signed contracts for major clients and suppliers
- Details of any auto-renewing or non-cancellable arrangements
- Notice periods, termination clauses and liabilities clearly set out
Buyers are wary of ‘handshake deals’. They may assume commercial risk and ask for protection where terms are missing.
5. IT, IP and Domain Names
Even small businesses are often reliant on technology, whether it’s a bespoke CRM system or an e-commerce platform. Buyers will want to know:
- Who owns your software, domain names and branding
- Whether licences are assignable
- Whether source code is accessible (if relevant)
- Whether any third party could challenge your use of key IP
If your website domain is registered in a director’s personal name, now is the time to sort that out. Likewise, confirm that any brand assets were properly created and assigned to the company.
I find that most small businesses just do not know the details about IT Systems, and most are reliant on small IT MSPs to assist.
Why Buyers Insist on Indemnities
From a buyer’s perspective, missing documents increase the risk of hidden liabilities. Their legal team will, therefore, push for specific indemnities to ringfence those risks.
These indemnities are:
- Direct: The buyer doesn’t need to prove breach of warranty, just that a liability arose.
- Financially uncapped (in most cases): Unlike warranties, which are usually capped, indemnities may not be, especially for tax or data protection issues.
- Long-lasting: They may survive for several years after completion.
For sellers, this creates uncertainty and potential costs well after the sale. Even worse, the buyer may withhold part of the purchase price until they’re satisfied there are no claims.
How to Get Sale-Ready
If you’re thinking of selling in the next 12 to 24 months, now is the time to get your house in order. Start with a simple audit:
- Are your corporate records complete and up to date?
- Do you have employment contracts and policies for all staff?
- Is your data protection compliance documented, not just assumed?
- Are key contracts signed, current, and assignable?
- Are you clear on who owns what when it comes to IP and IT?
If the answer to any of those is no, take action now. It’s far easier – and cheaper – to fix things in advance than to negotiate a way around them in the middle of a sale process.
I can help. I offer a comprehensive ‘get your business ready for sale’ package*, in which we carry out a full due diligence exercise and FIX the issues now, before you get a buyer being nervous about your sale.
*yes, I’m aware it’s not a particularly catchy name right now.
Final Thoughts
No business is perfect. But the more gaps in your paperwork, the more leverage you give to the buyer. It can affect the valuation and give an opportunity for the buyer to seek indemnities that keep you on the hook long after the deal is done.
So, think like a buyer, get your documents in order, and make sure you’re not giving away more than your business.
If you need help with a pre-sale legal audit or simply want to understand your position, feel free to contact me. It’s always better to prepare before the sale process begins than to patch things up under pressure.