What is Information Rights Management (IRM)? A guide for M&A deal teams

According to FTI Consulting’s 2026 CISO Redefined III report, nearly 1 in 4 executives surveyed experienced a cyber incident during or shortly after an M&A transaction. Protecting confidential documents shared with bidders, investors, and external advisors is key to managing transaction-related security risks.

Information rights management (IRM) helps organizations maintain control over sensitive documents even after they are downloaded. This guide explains how IRM works, its features and limitations, and how to choose IRM software.

Key Takeaways

• Information rights management (IRM) protects sensitive business documents through encryption and access permissions that can remain effective after files are downloaded or shared.
• Unlike digital rights management (DRM), which covers various forms of digital media, IRM focuses on protecting confidential business information.
• During M&A due diligence, IRM helps deal teams restrict access to sensitive documents when bidders withdraw.
• In Ideals VDR, the Encrypted permission level supports revocable, protected Office and PDF downloads.
• When choosing an IRM-enabled VDR, evaluate post-download revocation, file format support, document usability, plug-in-free access, and technical support.

What Is Information Rights Management (IRM)?

Information rights management (IRM) is a form of digital rights management (DRM) that uses encryption and access permissions to protect sensitive business documents. It controls who can open protected files and what authorized users can do with them, including viewing, editing, printing, and copying. Encryption is one component; IRM adds the policy that decides who may open the file and what they may do with it.

IRM can maintain these restrictions after files are downloaded or shared, with enforcement depending on the rights management system and compatible applications.

Businesses use IRM to protect confidential financial, legal, and corporate information, particularly during mergers and acquisitions (M&A) and due diligence conducted through virtual data rooms (VDRs).

IRM vs. DRM vs. Enterprise DRM (EDRM): What’s the Difference?

Digital rights management (DRM) is a broad category of technologies that control access to and use of digital media. In contrast, information rights management (IRM) applies these controls primarily to business information.

Information rights management vs. digital rights management

Enterprise digital rights management (EDRM) and information rights management (IRM) are commonly used to describe the same category of business document protection technologies. EDRM emphasizes enterprise-wide deployment, not a separate technology.

How Does IRM Work? Five Steps From Policy to Revocation

Information rights management (IRM) combines encryption with document-level permissions that remain attached to protected files after download or sharing, so administrators can update or revoke access even when copies remain on recipients’ devices.

The process generally involves five steps:

1. Set permissions. The document owner or administrator defines who can access a file and what they can do with it, such as viewing, editing, printing, or copying.
2. Protect the document. The IRM system encrypts the file and associates it with the access policy, so downloading or forwarding a protected copy does not remove its restrictions.
3. Verify access. When a recipient opens the file, compatible software checks their authorization through the rights management system before allowing the document to be decrypted.
4. Enforce restrictions. The software opens the document for authorized users and applies the access policy. Depending on the platform, document access and supported activities may also be logged.
5. Update or revoke permissions. Administrators can change access centrally without retrieving downloaded copies. Changes take effect when the system checks authorization again or when an existing authorization expires, depending on the system.

Key Features of IRM Software

Core IRM features work together to control a document after it leaves the sender. Availability and configuration depend on the provider and implementation.

• Granular access control: User-level permissions for viewing, editing, printing, copying, and forwarding.
• Document expiration: Set access validity periods for protected files, allowing permissions to expire automatically without manual intervention.
• Dynamic watermarking: Apply identifying information, such as a recipient’s name, email address, IP address, or timestamp, to discourage redistribution and help trace leaks.
• Activity tracking and audit trails: Record document access and supported user actions as evidence for investigations and compliance reviews.
• Persistent encryption: Protection that stays in place whether the file is stored, emailed, or downloaded.
• Offline access control: Limits how long a protected file can be opened without reconnecting to the rights management system.

Virtual data rooms combine several of these controls, including granular access permissions and watermarking, within a single deal workflow.

Why IRM Matters in M&A and Due Diligence

Information rights management due diligence controls help M&A deal teams protect confidential documents shared with bidders, investors, and external advisors. IRM in M&A is particularly valuable when participants withdraw from a transaction but retain downloaded copies of sensitive information.

Without adequate document protection, deal teams face several risks:

• Uncontrolled document access: If a bidder withdraws during due diligence, they may retain downloaded financial models, contracts, and intellectual property records. Without IRM protection, the seller may be unable to restrict further access to those copies.
• Financial consequences: Data breaches can trigger investigation costs, disrupt business operations, and reduce revenue. IBM’s 2026 Cost of a Data Breach Report puts the global average cost of a data breach at $4.99 million.
• Regulatory exposure: Leaked personal information may trigger GDPR obligations. According to DLA Piper’s GDPR Fines and Data Breach Survey 2026, GDPR fines totaled approximately €7.1 billion from May 25, 2018, through January 10, 2026, including approximately €1.2 billion in 2025.

IRM reduces reliance on recipients honoring confidentiality obligations by adding a technical safeguard alongside nondisclosure agreements (NDAs).

IRM in Virtual Data Rooms: What to Look For

Virtual data rooms (VDRs) use IRM to protect eligible downloaded documents, although supported formats, permission settings, and access requirements vary by provider. An IRM virtual data room adds this protection to ordinary VDR document security such as watermarking and permission levels. In Ideals VDR, the Encrypted permission level enables IRM-protected Office and PDF downloads, allowing administrators to revoke access even after files have been downloaded.

Here’s how Ideals implements IRM and complementary VDR document security controls:

• Eight permission levels: No access, Fence (browser viewing through a movable visible area), View, Encrypted (IRM-protected downloads), PDF (watermarked PDF downloads), Original (original-format downloads), Upload, and Manage. Permissions are assigned to participant groups.
• IRM-encrypted Office files: Under Encrypted permission, users can download IRM-protected Word, Excel, and PowerPoint files in native formats. Only authorized downloaders can open them with their Ideals credentials, and they need an internet connection for authentication.
• Protected PDF downloads: Under Encrypted permission, supported files can be downloaded as encrypted, watermarked PDFs with revocable access. Opening them requires Adobe Reader with the FileOpen plug-in and an internet connection.
• Excel formula controls: For encrypted Excel downloads, Formulas on lets users view formulas and edit files, while Formulas off hides formulas and disables editing and data analysis.

The eight permission levels govern access within the VDR; they are not eight separate usage policies for downloaded files. Under Encrypted permission, Ideals restricts copying and screenshots in protected Office files, as well as saving changes, except for Excel files with Formulas on.

Administrators can revoke access to previously downloaded encrypted files by changing the recipient group’s permission to No access or Fence, or by deactivating the user’s account. Revocation prevents the recipient from reopening the file, although documents already open remain accessible until closed. Revocation covers encrypted downloads only: Ideals notes that access to a downloaded original document cannot be revoked, and closing or freezing the project disables all downloaded encrypted files.

In practice, this maps to how deals run. When a bidder drops out, move its group to No access and its downloaded encrypted files stop opening. As the process narrows, move remaining groups from broad to staged permissions. For a wider checklist, see essential virtual data room features.

Common IRM Implementation Challenges and How to Avoid Them

IRM implementation can introduce challenges involving software compatibility, existing document protection, and corporate IT restrictions. Addressing these IRM challenges before sharing confidential files helps avoid access problems during time-sensitive due diligence reviews.

User Adoption

IRM-protected downloads may require compatible applications or additional plug-ins, which external reviewers may be reluctant or unable to install on corporate devices.

For example, IRM-encrypted Office files downloaded from Ideals VDR require Microsoft Office 2007 or later and cannot be downloaded on macOS. Mac users receive the encrypted PDF version instead, opened in Adobe Reader with the FileOpen plug-in.

Bidders and advisers who only need to review documents often don’t need protected downloads. Plug-in-free browser viewing with dynamic watermarks is usually enough; reserve encrypted downloads for teams that need them and have compatible software.

Compatibility With Existing Microsoft Information Rights Management

Some organizations already use Microsoft’s rights management capabilities through Microsoft 365 or SharePoint. Documents already encrypted through Microsoft Purview may need preparation before a VDR can open, convert, or display them.

Check documents for existing Microsoft encryption before uploading them. If necessary, have authorized IT staff prepare compatible versions, then test access with external-reviewer accounts.

Corporate Network Restrictions

Corporate firewalls and proxy servers may block the authentication services required to open IRM-protected downloads, preventing legitimate reviewers from accessing files.

Ask external reviewers to open a sample protected file, containing no sensitive information, before critical reviews begin. If authentication fails, their IT administrators should check whether network restrictions block the required rights management services.

How to Choose an IRM-Enabled VDR: A Quick Checklist

Use this IRM vendor evaluation checklist to choose IRM software that fits your deal’s document types, reviewer requirements, and security policies. Ask each vendor to demonstrate the workflows below with representative deal documents and reviewer accounts.

Once you’ve selected a provider, use these findings when building a data room checklist, particularly how documents are prepared, organized, and made accessible to different participant groups.

Conclusion: Protect Deal Documents Beyond the Download

Information rights management embeds protection in the document itself, so permissions and encryption can remain effective after a file is downloaded. It differs from DRM, which governs consumer media, and from EDRM, which is IRM applied across an organization. It matters most in M&A due diligence, where bidders and advisers hold copies of sensitive documents.

Before selecting an IRM virtual data room, test protected documents with realistic reviewer permissions and workflows.

FAQ