US Deal Data Rooms: Requirements for HSR, State Privacy Laws and Public Company Work

A domestic US acquisition can look simple on the term sheet and still bring four separate bodies of rules into the data room. The antitrust filing collects documents that discuss the deal. State privacy laws attach to customer and employee files. Health data, if any, brings HIPAA. And if either party is public, securities law turns every person with access into someone who holds material non-public information.

This article explains what each of those means for the room, what our United States top 10 rewards, and the questions to put to vendors before a US process opens.

How does an HSR filing touch the data room?

The Hart-Scott-Rodino Act requires parties to notify the Federal Trade Commission and the Department of Justice before closing transactions above set thresholds, then wait. For transactions closing on or after the 2026 adjustment in February, the minimum size-of-transaction threshold is $133.9 million, and deals above $535.5 million are reportable regardless of the parties’ size. Filing fees in 2026 run from $35,000 to about $2.46 million depending on deal value.

The filing asks for certain documents prepared by or for officers and directors that analyze the deal, such as board presentations and banker books. Those often live in the data room or alongside it. A room with a clear folder structure, an exportable index and a log of who uploaded what makes the collection quicker for antitrust counsel.

The rules around the form have moved recently. The FTC’s expanded HSR form, in use from February 2025, was vacated by a federal district court in February 2026, and after the Fifth Circuit declined to stay that ruling in March 2026, filers returned to the prior form while the appeal continues. Confirm the current form with antitrust counsel before you plan the document collection.

Which privacy laws apply to US deal data?

There is no single federal privacy law covering most deal data. Instead, a seller meets a set of state laws and sector rules.

The practical response is consistent across them. Upload the least personal data that answers the buyer’s question. Aggregate or de-identify customer lists for early rounds. Hold named employee files in a restricted folder for the final bidder. And make sure the vendor’s contract describes it as a processor or service provider for any personal data you upload.

HIPAA is the one case where the vendor itself must sign something specific. If protected health information goes into the room, you need a business associate agreement. In our facts, Box and Citrix ShareFile are the two providers that list HIPAA; for any other vendor, ask before uploading health data.

What does public company work add?

When either party is listed, confidentiality becomes a securities question as well as a contractual one. Everyone with access to deal information holds material non-public information, and the company’s counsel will want to know exactly who that is and when they got it.

A data room helps in three ways. Named accounts with two-factor login make the insider list accurate. The audit trail shows when each person first opened sensitive material, which supports insider-list records. And dynamic watermarks deter forwarding to people who are not on the list. Ask whether the room can export a dated list of all users with access to a given folder, because that is the report counsel will request.

Do government-adjacent deals need FedRAMP?

Sometimes, and it is worth asking early. FedRAMP is the US government’s authorization program for cloud services used by federal agencies. It applies when an agency itself uses the service. A private acquisition of a government contractor does not normally require a FedRAMP-authorized data room, but if the target’s files include federal information covered by its contracts, counsel may set stricter hosting conditions.

Defense contractors raise a related question. The Defense Department’s CMMC requirements began phasing into contracts in November 2025, and files containing controlled unclassified information carry handling rules. Our facts file does not record FedRAMP or CMMC status for any provider, and few deal rooms make such claims. Ask the vendor in writing, and ask the target’s compliance lead which files are covered before anything is uploaded. For more on rooms used in the public sector, see our guide to data rooms for sensitive government files.

What does the US list reward?

The United States list keeps the overall weighting and adds three bonuses: a US head office (+3), SOC 2 listed (+1) and HIPAA listed (+1.5). A US head office is a proxy for US-hours support, US-law contracts and familiarity with US deal habits; it is not a statement about hosting.

The two leaders show different strengths. Datasite pairs a US head office with ISO 27001, SOC 2 and single sign-on, and a long record on large US transactions; its comparison with Intralinks covers the two most established US platforms. Ellty leads on its base marks, including a published $149 monthly price, while its SOC 2 covers the hosting infrastructure and it lists no SSO. Venue by DFIN, a capital-markets specialist, sits outside the top 10 on our model; its profile explains where it fits for IPO and public company work.

Related top list Top 10 data rooms for US deals Overall score plus credit for a US head office, SOC 2 and HIPAA, for buyers who prefer a US vendor. 1Ellty2Datasite3iDeals See the full list →

Which questions should a US deal team ask?

Use the feature checker to filter the 18 tracked providers on SSO, two-factor login, redaction and audit trail before the vendor calls.