Selling company data in UK administration or liquidation
In the United Kingdom, a company that cannot pay its debts usually ends up in administration or liquidation, run by a licensed insolvency practitioner. The company’s email, Teams or Slack history, ticket systems and CRM records are part of its property, and the office holder can sell or license them to AI companies to get a better return for creditors. The personal data inside them stays under the UK GDPR the whole time.
Who has the power to sell
The administrator’s power to sell or otherwise dispose of the company’s property is in Schedule 1 to the Act, and the purpose of administration, rescuing the company or getting a better result for creditors than a winding up, is set by Schedule B1. A liquidator’s powers are in Schedule 4.
| Process | Who acts, and on what authority |
|---|---|
| Administration | The administrator, an insolvency practitioner who acts as the company’s agent and manages its affairs, business and property under Schedule B1 to the Insolvency Act 1986. |
| Creditors’ voluntary liquidation | The liquidator chosen by the members and creditors, with the powers in Schedule 4 to the Act, which include selling the company’s property. |
| Compulsory liquidation | The official receiver first, then often a liquidator appointed in their place. The first enquiries aim to find and secure the books and records. |
Personal data and the UK GDPR
Records full of names and messages are personal data, and an insolvency does not switch the UK GDPR or the Data Protection Act 2018 off. Selling personal data needs a lawful basis and has to fit what people were told when it was collected, which a buyer training models will rarely be able to rely on.
Anonymisation solves most of this. Data that is effectively anonymised is outside the UK GDPR, and the ICO’s guidance on anonymisation sets out how to judge whether a person could still be identified. More on the UK rules is on our United Kingdom page.
What an office holder should do early
- Ask whether the software subscriptions are still paid. Cloud providers delete closed accounts after a set period.
- Secure one administrator login for each system and record what each holds and for how many years.
- Keep the privacy notices and customer terms, in each version.
- Note the headcount at the company’s peak, not on the day of appointment.
- Treat the records as one more asset in the sale, with an anonymous summary first and no data sent before a deal.
Read next
- Closing or bankrupt companies. Who signs in each kind of closing.
- AI data licensing in the UK. The UK seller page.
- What company data is worth. Ranges by data type and company size.
- De-identification. How names and personal details come out first.
Questions about selling company data in UK administration or liquidation
Can a pre-pack sale include the company’s records?
It can, as part of the business and assets sold. A sale to a connected party has its own extra steps under the 2021 regulations, which the administrator handles.
Who signs the licence?
The administrator or liquidator, on behalf of the company, using their statutory powers.
Does the buyer take on our data protection duties?
If it receives personal data, yes, as a new controller. If the data is anonymised first, that question mostly falls away.
Didn't find your question? Ask us directly.