A seller of a UK business is under no general legal duty to tell a buyer what is wrong with it. The governing principle is caveat emptor, buyer beware, and legal due diligence is the process by which a buyer closes the gap between what it has been told and what it is actually acquiring. Everything a buyer fails to discover, and fails to protect itself against in the contract, becomes the buyer’s problem on completion.
We act for buyers and sellers on business acquisitions across England and Wales, and the single biggest difference between a deal that works and a deal that generates a dispute two years later is the quality of the diligence that sat behind it. This guide sets out what legal due diligence covers, how the process runs in practice, what gets reviewed area by area, how findings translate into price, warranties, indemnities and conditions, and the red flags that justify walking away.
What legal due diligence is, and what it is not
Legal due diligence is a structured investigation of the legal foundations of a target business: whether the seller owns what it is selling, what the business is contractually committed to, what liabilities it carries, and whether anything about the transaction itself will break something that currently works.
It is routinely confused with three other things, and the confusion costs buyers money. It is not an audit: an audit tests whether accounts give a true and fair view, whereas legal diligence asks whether the contracts and obligations behind those numbers hold up. It is not a valuation: diligence tells you what risks attach to a price, not what the price should be. And it is not a guarantee: diligence works on the documents and answers the seller provides, so a deliberately concealed liability is addressed by the warranty and indemnity regime in the purchase agreement, not by the review itself.
| Workstream | Question it answers | Who usually runs it |
|---|---|---|
| Legal due diligence | Does the seller own it, what is it committed to, and what can go wrong legally? | Buyer’s solicitors |
| Financial due diligence | Are the numbers real, and is the profit sustainable? | Buyer’s accountants or a corporate finance team |
| Tax due diligence | What historic tax exposure comes with the company? | Tax advisers, with the tax covenant drafted by solicitors |
| Commercial due diligence | Is the market, customer base and competitive position what the seller says? | The buyer, sometimes with specialist consultants |
| Audit | Do the statutory accounts give a true and fair view? | Auditors, and only where the company is audited |
These overlap at the edges. Employment diligence turns up payroll liabilities that belong in the financial model, and property diligence turns up dilapidations exposure that belongs in the price. A sensible buyer makes sure the legal, financial and tax teams see each other’s findings rather than working in sealed boxes.
Why the law puts the burden on the buyer
In a private company sale there is no statutory disclosure regime comparable to the one that applies on a residential conveyance. A seller must not make a false statement that induces the buyer to contract, which would open the door to a misrepresentation claim, but silence on an unflattering fact is generally not actionable on its own. That is why the buyer’s protection is constructed, not assumed: it comes from the diligence exercise, from the warranties the seller gives in the sale agreement, and from indemnities covering identified risks.
The structure of the deal changes how much of the burden falls on diligence. On a share purchase the buyer acquires the company with its entire history attached, including liabilities nobody has yet discovered, which makes diligence wide and deep. On an asset purchase the buyer takes only the assets and contracts listed in the agreement, which narrows the exposure but creates a different problem: every contract, lease, licence and consent has to be transferred, and anything the buyer forgets to take simply stays behind. We cover the choice in detail in our guide to share sale versus asset sale, and the wider transaction sequence in our step-by-step guide to buying a business in the UK.
How the due diligence process actually runs
Diligence normally begins once heads of terms are agreed and, on most SME deals, once the buyer has secured a period of exclusivity. Running a full review without exclusivity means paying for a process the seller can abandon the moment a better offer arrives, which is why we usually advise buyers to settle exclusivity arrangements before the first information request goes out.
The legal due diligence process, step by step
| 1 | Scope and information request The buyer’s solicitors issue a due diligence questionnaire, scaled to the size and sector of the target. A thirty page standard questionnaire on a two person business wastes everybody’s time and money. |
| 2 | Data room opened The seller uploads documents to a virtual data room with controlled access and an audit trail. What goes in the data room is also what the seller will later rely on as disclosure against the warranties, so the index matters. |
| 3 | Written replies The seller’s solicitors answer the questionnaire in writing. Replies are evidence: they are usually deemed to be disclosed against the warranties, and an inaccurate reply can found a misrepresentation claim. |
| 4 | Follow-up enquiries Gaps, evasive answers and missing signatures are chased in further rounds. This is where most real findings emerge, not in the first response. |
| 5 | Report to the buyer Usually a red flag report on an SME deal: the issues that affect price, structure or whether to proceed, rather than a description of every document reviewed. |
| 6 | Findings fed into the deal Price adjustments, specific indemnities, conditions to completion, retentions and amended warranties are negotiated off the back of the report. |
Typical duration on an owner-managed business: three to eight weeks from questionnaire to report, running alongside the drafting of the sale agreement rather than after it.
Sellers who prepare for this in advance get better outcomes and shorter timetables. We look at that side of the process separately in our guide to vendor due diligence.
What gets reviewed, area by area
Corporate and share capital
The first question is whether the seller can actually pass title to what is being sold. That means tracing the share capital from incorporation: every allotment, transfer, buyback, option, warrant and convertible instrument, checked against the articles and any shareholders’ agreement. Pre-emption rights that were not waived, transfers never approved by the board, and option grants nobody told the buyer about are all common, and all capable of leaving a buyer holding less than it paid for.
Companies House records need checking rather than assuming. Identity verification for directors and people with significant control became a legal requirement on 18 November 2025, with a twelve month transition period for existing appointments, so a 2026 buyer should confirm that the target’s directors and PSCs have verified by their due dates. Non-compliance is an offence and blocks the company from making filings, which is an awkward position to inherit the day after completion.
Contracts and change of control
A share sale does not change the identity of the contracting party, which leads buyers to assume contracts simply carry on. Change of control clauses defeat that assumption: many customer contracts, supply agreements, franchise agreements, leases and funding facilities give the counterparty a right to terminate, renegotiate or demand consent when ownership changes. On an asset purchase the problem is sharper still, because contracts must be assigned or novated and most commercial contracts restrict assignment without consent.
The review should concentrate on contracts that matter: the customers producing most of the revenue, the suppliers the business cannot replace quickly, anything with exclusivity or minimum volume commitments, and any guarantee or indemnity the company has given. Agency arrangements deserve particular attention, since a commercial agent may be entitled to compensation or an indemnity on termination regardless of what the contract says. Our commercial contracts team reviews these alongside the corporate workstream rather than after it.
Employees
Employment is where undisclosed cost most often hides. The review covers the employee list and status of each person, written statements of particulars under section 1 of the Employment Rights Act 1996, contractor and consultancy arrangements, restrictive covenants protecting the business, pension and auto-enrolment compliance, holiday accrual, and live or threatened claims and grievances.
Two current changes matter for a buyer in 2026. From 1 October 2026 the time limit for bringing most Employment Tribunal claims increased from three months to six months, so the window in which a disgruntled former employee can still issue is twice as long as the one buyers were used to. From 1 January 2027 the qualifying period for ordinary unfair dismissal falls to six months for dismissals on or after that date, and the compensatory award becomes uncapped, which changes the risk profile of any restructuring a buyer is planning after completion.
On an asset purchase, and on many outsourcing and service provision changes, TUPE applies and employees transfer automatically on their existing terms. The seller must provide employee liability information to the buyer not less than 28 days before the transfer under regulation 11 of the TUPE Regulations 2006, and that information must be accurate as at a date no more than fourteen days before it is given. We deal with the mechanics in our article on TUPE when buying or selling a business, and our employment team runs this workstream on acquisitions.
Property and leases
Where the business trades from leasehold premises, the lease is often the second most valuable thing being acquired after the customer base. The review covers title, term, rent and rent review mechanics, repairing obligations and likely dilapidations exposure, service charge, break clauses and their conditions, and whether the landlord’s consent is needed to assign or on a change of control.
The critical question is security of tenure. A business tenancy within Part II of the Landlord and Tenant Act 1954 carries a statutory right to renew, unless the parties contracted out under section 38A, which requires the landlord’s warning notice and the tenant’s declaration in the prescribed form. A buyer paying for goodwill tied to a location needs to know whether the business has a right to stay there or is occupying at the landlord’s pleasure. Our commercial property solicitors handle this limb, and we have set out the recurring problems in our note on commercial lease red flags.
Intellectual property and IT
Ownership is the recurring failure point. Registered trade marks, patents, designs and domain names are frequently held in the name of a founder, a dormant group company or a former agency rather than the company being sold. Copyright in software, designs and marketing material created by contractors stays with the contractor unless it has been assigned in writing, and a surprising number of businesses have never obtained that assignment.
Registration of transactions matters too. Under section 25 of the Trade Marks Act 1994 an unregistered assignment is ineffective against a person who later acquires a conflicting interest in ignorance of it, and a new proprietor who does not apply to register within six months of the transaction risks being refused its costs in later infringement proceedings. The review also covers licences in and out, change of control in software and SaaS contracts, open source usage and source code escrow. Our IP due diligence team handles the specialist portfolio review where intellectual property is central to the value of the deal.
Data protection
On a share purchase the buyer inherits the company’s entire compliance history, including any breach that has not yet surfaced. The review covers records of processing, privacy notices and lawful bases, data processing agreements with suppliers, international transfer arrangements, the personal data breach log, any correspondence with the Information Commissioner’s Office, outstanding subject access requests, and the consent position for marketing lists.
The exposure is not theoretical. Under section 157 of the Data Protection Act 2018 the higher maximum penalty is £17.5 million or 4% of total annual worldwide turnover, whichever is higher, with a standard maximum of £8.7 million or 2%. A customer database acquired without a defensible lawful basis is a liability wearing the costume of an asset. Our data protection solicitors cover this workstream, and we have written separately on UK data protection compliance for SMEs.
Litigation and disputes
The question is not only what is being litigated now but what could still be brought. Under the Limitation Act 1980 an action founded on simple contract must be brought within six years of the cause of action accruing, and twelve years where the obligation is contained in a deed. A buyer therefore needs visibility of disputes, complaints and defective work going back further than the current year end, including matters settled without proceedings and any warranty claim the company itself faces from a business it previously bought or sold.
Regulatory and licensing
Where the business needs a licence or registration to trade, the first question is whether it transfers at all. Most sector authorisations, including Care Quality Commission registration, General Pharmaceutical Council registration and premises licences, are personal to the holder, which means an asset purchase usually requires a fresh application and a share purchase usually requires notification and sometimes prior approval. Completing before the regulator has dealt with the application leaves the buyer owning a business that cannot lawfully operate.
Corporate criminal exposure also sits in this limb. The failure to prevent bribery offence under section 7 of the Bribery Act 2010 applies to commercial organisations of any size, and the failure to prevent fraud offence under section 199 of the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025 for large organisations, defined in section 201 as those meeting two or more of: turnover above £36 million, balance sheet total above £18 million, or more than 250 employees. A buyer that is itself a large organisation inherits the compliance gap of anything it acquires. Sector specific checklists are set out in our guides to buying a care home, buying a pharmacy and dental practice due diligence.
Insurance
Insurance is the area most often skimmed and most often regretted. The review covers the policy schedule, sums insured against actual replacement cost, the claims history, and whether any cover is written on a claims made basis, which matters because professional indemnity and directors’ and officers’ policies respond to claims notified during the policy period rather than to the year in which the work was done. Where the target has been insured under a group policy, that cover usually falls away on completion, leaving a gap on day one unless run-off cover is arranged in advance.
Tax
On a share purchase the buyer takes the company’s whole tax history. The legal workstream checks for open HMRC enquiries, correspondence, the VAT and PAYE position, the treatment of contractors, and historic reliefs and claims that could be challenged, and then translates the exposure into a tax covenant in the sale agreement under which the seller bears pre-completion tax liabilities. The quantification of that exposure belongs with your accountant or tax adviser, and you should confirm your own tax position with them before agreeing a structure or a price.
The legal due diligence checklist
This is the checklist we work from on an owner-managed business acquisition. Scale it to the deal: the point of a proportionate review is to spend the budget where the risk actually sits, not to send a questionnaire built for a listed company to a business with eight employees.
| What to request | What you are looking for | Why it matters to a buyer |
|---|---|---|
| 1. Corporate and share capital | ||
| Certificate of incorporation, articles, shareholders’ agreement, statutory registers including the register of members and PSC information | Unbroken chain of title to every share, pre-emption rights properly waived, board approvals in place | You cannot acquire shares the seller does not own, and a defective transfer years ago is still defective today |
| Share allotment, transfer, buyback and option history, warrants, convertible loans, EMI scheme documents | Instruments that could dilute you after completion | An unexercised option is a claim on the equity you are paying for |
| Companies House filing history, charges register, confirmation statements, director and PSC identity verification status | Undischarged charges, late or missing filings, unverified appointments | A registered charge survives the sale, and unverified directors cannot make filings |
| 2. Contracts and change of control | ||
| Top customer and supplier contracts by revenue, signed and dated | Change of control and assignment clauses, termination on short notice, exclusivity, minimum volumes | The revenue you are buying can walk the week after completion |
| Standard terms of business, agency and distribution agreements, franchise agreements | Whether terms were actually incorporated, and agent compensation rights on termination | Liability caps the business thinks it has may never have been agreed |
| Guarantees, indemnities, finance and facility agreements, asset finance and leases | Obligations owed to third parties and events of default triggered by the sale | Completion itself can accelerate a facility or crystallise a guarantee |
| 3. Employees | ||
| Anonymised employee list with role, start date, pay, hours, notice and status, plus section 1 written statements | Continuity of service, enhanced contractual terms, missing or outdated contracts | Long service means expensive redundancy, and enhanced terms transfer with the people |
| Consultancy and contractor agreements, self-employment arrangements, umbrella and agency usage | People treated as self-employed who are arguably employees or workers | Historic PAYE, national insurance and holiday pay exposure sits with the company |
| Live and threatened claims, grievances, disciplinary records, settlement agreements | Anything within the Employment Tribunal time limit, now six months for claims from 1 October 2026 | The look-back window for unissued claims is twice as long as it used to be |
| Restrictive covenants for key staff, pension and auto-enrolment records, holiday accrual, TUPE employee liability information | Enforceable protection of the customer base and a clean auto-enrolment record | If covenants are unenforceable, the seller’s team can compete from day one |
| 4. Property and leases | ||
| Leases, licences to occupy, official copies of registered title, licences to alter | Whether the tenancy is protected under Part II of the Landlord and Tenant Act 1954 or contracted out under section 38A | Goodwill tied to a location is worth far less without a right to renew |
| Rent review and break clause provisions, service charge accounts, schedules of condition, consents for alterations | Dilapidations exposure, conditional break rights, unconsented works | A full repairing liability on a tired building is a real and often large number |
| Landlord consent requirements on assignment or change of control, planning permissions and permitted use | Whether the deal needs the landlord’s agreement, and on what terms | A landlord can demand a rent deposit or guarantee as the price of consent |
| 5. Intellectual property and IT | ||
| Schedule of registered trade marks, patents, designs and domain names, with register extracts | Rights registered in the name of the company being sold, renewals paid, assignments recorded | Marks held personally by a founder do not transfer with the shares |
| Written assignments from employees, contractors, designers and developers | Whether copyright in software, branding and content was ever assigned | Without an assignment the contractor still owns the work you are paying for |
| Licences in and out, software and SaaS contracts, open source register, source code escrow | Change of control restrictions and licences that are personal to the current owner | A core system licence that terminates on sale stops the business working |
| 6. Data protection | ||
| Record of processing activities, privacy notices, lawful bases, retention policy | Whether the customer and employee data can lawfully be used the way the business uses it | Penalties reach £17.5 million or 4% of worldwide turnover |
| Processor agreements, international transfer documentation, breach log, ICO correspondence, outstanding subject access requests | Unreported breaches and live regulatory contact | On a share purchase the regulatory history comes with the company |
| 7. Litigation and disputes | ||
| Schedule of live, threatened and settled disputes, correspondence from solicitors, complaint records | Anything within six years for contract claims, or twelve where the obligation is in a deed | A settled complaint can still become a claim inside the limitation period |
| Warranty claims under earlier acquisitions, defective work and product recall history, bad debts | Liabilities the company inherited from its own past deals | You are buying the company’s claims and its exposures together |
| 8. Regulatory and licences | ||
| All sector registrations and licences, inspection reports, enforcement correspondence, conditions imposed | Whether the authorisation transfers, needs re-application or requires regulator consent to the change of control | Completing before approval can leave you unable to trade lawfully |
| Anti-bribery and anti-fraud procedures, sanctions and anti-money laundering checks, product compliance and health and safety records | Reasonable prevention procedures, accident and enforcement history | Corporate criminal exposure follows the company on a share purchase |
| 9. Insurance | ||
| Policy schedule, certificates, claims history for at least the last five years | Gaps in cover, inadequate sums insured, repeated claims of the same type | A claims pattern tells you about the business the accounts do not |
| Whether cover is claims made or occurrence based, and whether policies are held at group level | Need for run-off cover from completion | Group cover usually ends the moment the company leaves the group |
| 10. Tax | ||
| HMRC correspondence, open enquiries, VAT, PAYE and CIS position, reliefs and claims made | Exposure that will be covered by the tax covenant rather than the warranties | Pre-completion tax liabilities belong to the seller only if the agreement says so |
How findings feed into price, warranties and indemnities
Diligence is only worth the fee if the findings change the documents. The question for each issue is not simply how serious it is, but how certain it is and who should carry it. A quantified liability that will definitely crystallise belongs in the price. A specific risk that may or may not crystallise belongs in an indemnity. An unknown general risk belongs in a warranty. Something that must be put right before you can properly own the business belongs in a condition to completion.
| What diligence turns up | Usual response in the deal |
|---|---|
| A certain, quantifiable liability, for example historic holiday pay underpaid across the workforce | Reduction in the headline price, or a retention held back from completion monies |
| A specific identified risk that may or may not bite, for example an open HMRC enquiry or a threatened tribunal claim | A specific indemnity on a pound for pound basis, often outside the general warranty cap and with its own time limit |
| Unknown risk across an area that looks clean but cannot be fully verified | Warranties in the sale agreement, qualified by the disclosure letter, with a cap and claim time limits |
| Something that must be fixed first, for example a missing landlord consent or an unregistered IP assignment | A condition precedent, so the buyer is not obliged to complete until it is done |
| A structural concern about future performance, for example heavy customer concentration | Restructure the consideration: earn-out, deferred consideration, or a longer handover from the seller |
| A fundamental defect that cannot be fixed or priced | Walk away |
Two points are regularly misunderstood by buyers. First, a warranty is not insurance: if the seller discloses the problem properly in the disclosure letter, the buyer cannot later claim on the warranty for it, which is why diligence findings and the disclosure exercise have to be read together. Second, a warranty claim requires the buyer to prove loss and to work within the caps and time limits in the agreement, whereas a well drafted indemnity gives a direct pound for pound recovery. Our articles on warranties and indemnities and on the disclosure letter explain how the two interact.
Red flags that justify walking away
Most findings can be priced, indemnified or made a condition. A small number cannot, and recognising them early saves a great deal of money. In our experience the following are the ones that most often end a deal, and should:
- The seller cannot establish clean title to the shares or assets being sold, and the gap cannot be rectified before completion.
- Replies to enquiries are evasive on one specific point while being full and prompt on everything else. Selective evasion is usually a signal, not an oversight.
- A licence or registration the business cannot trade without will not transfer, and the regulator has given no indication it will grant a fresh one to the buyer.
- Undisclosed litigation, or a contingent liability, of a size approaching or exceeding the purchase price.
- Documents that do not reconcile with each other: board minutes that post-date the events they record, contracts signed by people who had already left, or registers reconstructed after the enquiry was raised.
- A workforce engaged as self-employed contractors where the facts point firmly to employment, with several years of unprotected PAYE, national insurance and holiday pay exposure behind it.
- The dominant customer relationship is personal to the departing owner and the contract is terminable at will, so the asset you are paying for leaves with the seller.
- The seller refuses to give meaningful warranties, or insists on a liability cap so low that the warranty package has no practical value.
Walking away is a legitimate outcome of a properly run diligence exercise, not a failure of it. The cost of the review is almost always a fraction of the cost of acquiring a business with a defect you did not find.
What this means for you
Scope the review to the risk in the business rather than to a standard template, secure exclusivity before spending real money on it, and make sure the output is a report that changes the sale agreement rather than a description of documents. Buyers who treat diligence as a box to tick pay for it later, in a price they should not have paid or in a claim they cannot bring because the issue was disclosed and they did not read the disclosure letter closely enough.
We act for both buyers and sellers on acquisitions of owner-managed businesses, which means we know what a seller will resist and where a buyer has genuine leverage. If you are considering an acquisition and want the diligence run properly, speak to our business acquisition solicitors or our wider mergers and acquisitions team. Call us on +44 207 566 1188 or email info@gurvelegal.com and we will tell you honestly what the review should cover and what it is likely to cost.
