Selling company data in liquidation or administration: a UK guide for office-holders

This guide explains the law in plain terms. It is not legal advice: take advice from an insolvency solicitor on each case.

How often this arises. In 2025, 2,520 businesses with 20 to 249 employees entered insolvency in England and Wales: 1,540 creditors' voluntary liquidations, 570 administrations, 320 compulsory liquidations and 85 other procedures, in rounded counts³³. Businesses with 20 to 49 employees had the highest insolvency rate of any size band, at 269 per 10,000, and administration accounted for 40% of insolvencies among businesses with 100 or more employees³². There were 1,882 company insolvencies in September 2026 alone³¹. Our analysis of the UK company data licensing market sets these figures in a wider context.

Who has power to sell or license the company's records?

The office-holder does, acting for the company. In England and Wales an administrator may "sell or otherwise dispose of the property of the company"¹ and a liquidator may "sell any of the company's property by public auction or private contract"². Records the company owns are part of that property¹⁰, and the licence is signed in the company's name.

Since 26 May 2015 liquidators have been able to exercise the Schedule 4 powers without first seeking sanction^2,3.

The Act does not mention data or licences. A licence grants rights over a copy while the company keeps its records, and both schedules include catch-all powers for incidental and necessary steps^1,2. Licensing structures are already used for intangibles: in the 2019 administration of Loot Financial Services, Hilco Streambank completed deals with several parties using a "non-exclusive-licensing and purchase structure" for brand and software rights⁹. Whether a particular data licence falls within these powers is a question for the office-holder's insolvency solicitor on the facts of each case.

The company can only license what it owns or may license. Client-confidential files, material written by customers or suppliers, and anything restricted by contract need separate checks; see our UK law guide and the licence terms checklist.

Is the office-holder a data controller?

For data the company held before the appointment, usually the company remains the controller and the office-holder acts as its agent. The office-holder is a controller in their own right for data processed as principal, and the ICO's code still expects them to run the data sharing steps.

In Re Southern Pacific Personal Loans Ltd (High Court, 8 August 2013), the joint liquidators of a company in creditors' voluntary liquidation asked whether they were data controllers under the Data Protection Act 1998 for its borrower records¹⁰. The Information Commissioner argued that both the company and the liquidators were controllers¹⁰. David Richards J held that the liquidators were not, because the rights to control the data stayed with the company and the liquidators acted as its agents. He saw no fundamental difference for a compulsory liquidation, and said the liquidators "are not personally responsible for compliance" for that data¹⁰. Office-holders remain controllers where they act as principal, for example when adjudicating proofs of debt^10,11.

Three cautions:

1. The case was decided under the 1998 Act, before UK GDPR.
2. It concerned liquidators. Administrators also act as the company's agent by statute⁷, and in a later case from the Cambridge Analytica administration, reported by Gateley, the court treated Southern Pacific as settling that the duties were the company's. It said administrators should ask what the company must do to meet its obligations and what they can do, within their powers, to enable it¹¹.
3. The ICO's code says "you might be an insolvency practitioner or other adviser taking the role of controller for the time being"¹².

What this means for you. In practice, treat the company's duties as yours to discharge. Licensing records to an AI developer is a new purpose, and whoever is the controller needs a lawful basis and transparency for it. Gateley reports R3 guidance that office-holders cannot disclaim data as onerous property simply because it carries data protection obligations¹¹.

What does the ICO data sharing code require on an insolvency sale?

The code says that on insolvency "data might be sold as an asset", and lists nine things to do¹². Most can be done before any buyer is approached.

After a transfer the code adds four duties: check records are accurate, document what you do, apply a consistent retention policy and keep the data secure¹². The page carries a notice that it is under review because of the Data (Use and Access) Act¹².

The cleanest route is to de-identify before anything leaves the company. Pseudonymised data is still personal data¹³; data is anonymous only when the risk of identification is "sufficiently remote", judged by the means reasonably likely to be used and a "motivated intruder" test¹⁴. Our anonymisation standard explains how we apply this. Where a buyer removes personal data after transfer instead, Sleeping Asset tells the office-holder in writing first, and the company's solicitor approves the transfer route before anything moves.

What did the FCA, ICO and FSCS warn insolvency practitioners in 2020?

On 7 February 2020 the three regulators warned that some insolvency practitioners and FCA-authorised firms had tried to sell clients' personal data to claims management companies unlawfully, before or after administration¹⁷. They said standard contract terms are "highly unlikely to constitute sufficient legal consent", and that they would act on breaches¹⁷.

The statement concerned identifiable customer data passed on for marketing, which is a different activity from licensing de-identified operating records. Our reading of the lessons for an AI licence:

• Old contract terms and privacy boilerplate do not authorise a new use.
• Regulators have addressed insolvency practitioners on this specifically.
• Assess the purpose before records leave the company, and remove personal data first where you can. If a buyer is to remove it after transfer, agree that route in writing on legal advice.

How do you preserve data in the first 14 days?

Secure administrator access and stop the deletion clocks before anything else. Cloud providers delete or hide data on fixed timetables once bills go unpaid, and an operating archive can be lost within weeks.

Days 0 to 3: stop the clock

1. List every system (email, chat, file storage, ticketing, CRM, code, accounting, HR), who pays for it and when it renews.
2. Keep critical subscriptions paid, or get a written retention extension. Never delete a subscription.
3. Take control of one administrator login per system²²; change passwords, enforce multi-factor sign-in and remove former staff's admin rights.
4. Record each system's retention settings and switch on any hold feature it offers.

Days 4 to 7: record the context

5. Collect every version of privacy notices and customer terms²², plus staff handbooks and monitoring policies.
6. Record headcount at its peak, not on the day of appointment²²; buyers' size criteria often turn on it.
7. Locate and ring-fence HR, health, grievance and criminal records data.
8. Flag client-confidential and third-party material.

Days 8 to 14: secure and inventory

9. Export or snapshot key systems to UK storage, with a chain of custody log: who, when, what, where, and file hashes.
10. Build the records inventory from metadata only: system, years, volume, language.
11. Diary each provider's deletion date.
12. Log any subject access requests; do not destroy data covered by one, as Gateley warns of possible criminal sanctions¹¹.
13. Decide whether to realise, retain or dispose. In Southern Pacific the court directed that data no longer needed could be disposed of in a way consistent with data protection law¹⁰.

Appointments are gazetted under notice codes 2410 (administrators), 2443 (liquidators in a creditors' voluntary winding up) and 2454 (liquidators in a winding up by the court)²³; date your preservation log from the appointment. When we work on a case, these steps become the preservation plan in your case file; see what we do in the first week of an appointment.

How do you value operational data for the estate?

There is no price list. Value depends on whether the company meets each buyer's published criteria, how many years and systems it covers, what must be excluded, and what a buyer pays after review. Buyers decline some companies after evaluation²⁴, so record your reasoning in a valuation memo.

Published reference points:

• micro1 Defunct Company Data Partnership: 30 or more employees, records in English, and "USD 100K to 3M+ for approved data packages"²⁴. micro1 takes up to 30 days to review data and pays within 30 days of invoice²⁵.
• Scale AI: "USD 10K to 1M+ illustrative value per data partnership", with 40 or more employees preferred²⁶.
• Price uncertainty: buyers "quote wildly different numbers" because valuations rest on "research theses", according to Surge AI³⁸.

Our buyers page lists each buyer's criteria with checked dates, and our valuation page explains how we estimate value.

How do you run a sale that shows best value?

Approach more than one buyer, compare price alongside de-identification method, certainty and terms, avoid long exclusivity, and keep a record. The Insolvency Code of Ethics lists disclosure of "the process undertaken to evaluate best value and service" as a safeguard for referral and agency arrangements³⁰.

1. Run each buyer's own process. micro1 requires the company itself to register through a referral link and complete its own data manifest; manual introductions do not replace that²⁴. Here the company acts by its office-holder.
2. Compare more than price. Spirit's advisers weighed the proposed de-identification method and transaction certainty as well as headline price³⁴.
3. Prefer non-exclusive terms. The Loot administration licensed rights to several parties⁹; Cognor Labs says most of its agreements carry exclusivity, typically 24 months²⁷.
4. Check timing against the case. micro1, for example, allows itself 30 days to review delivered data, then pays within 30 days of invoice²⁵.
5. Watch connected parties. A liquidator must notify any liquidation committee of a disposal to a connected person^3,4.
6. Record everything: buyers approached, responses, offers and the reasons for your choice.

How does SIP 9 apply to fees, and what will creditors ask?

On its wording, SIP 9 governs payments from an estate to office-holders and their associates²⁸. A fee a buyer pays an unconnected agent is not an estate payment, but creditors will want it disclosed and will ask whether it reduced the price paid to the estate.

SIP 9 for England and Wales took effect on 1 April 2021 and applies to all Insolvency Act proceedings except Part A1 moratoriums, and members' voluntary liquidations unless those paying require it²⁸. It treats anyone a reasonable and informed third party might see as associated as an associate, classes estate payments to non-associates as category 1 expenses, and asks office-holders to explain sub-contracted work that they or their staff could otherwise do: why, what, and how much²⁸.

The Insolvency Code of Ethics, which applies from 1 October 2025, adds three rules that matter here [30]:

• Referral fees or commissions must not be accepted by the insolvency practitioner, the firm or an associate during an appointment unless paid into the estate and disclosed to creditors (R2340.7).
• The reasons for recommending a particular provider must be documented (R2330.10).
• Information about a referral should cover any direct or indirect benefit to the practitioner or firm, and that similar services may be available elsewhere at a different cost (2330.11 A3).

Questions creditors are likely to ask:

• Who introduced the buyer, who paid them, and how much?
• Is the agent connected to the office-holder or the firm?
• Did the agent's fee come out of the price paid to the estate?
• How many buyers were approached, and why this one?
• What was excluded from the licence, and why?
• What may the buyer do with the data, for how long, and is it exclusive?
• What did realisation cost the estate?

The estate pays Sleeping Asset nothing: the buyer pays our fee, and we disclose it in writing to the office-holder before any licence so it can be reported to creditors. See what our fee disclosure note contains and how we are paid.

What does the Spirit Airlines sale show, and what does it not?

It shows that an insolvent company's internal records can attract competitive bids from AI companies, and that sellers' advisers weigh the de-identification method alongside price. It does not set a UK precedent, a price for smaller companies, or a privacy standard UK law would accept.

Spirit ceased operations in May 2026 and its data was auctioned in US Chapter 11 proceedings in New York on 14 August 2026³⁴. Google's USD 10 million bid beat Mercor's USD 7.5 million³⁴; micro1 later proposed USD 12.5 million³⁵. The dataset was reported in September as about 100 million emails, 500 million Teams messages and 30 million lines of code³⁴. Skift reported on 10 November that, under revised terms set out in a court filing, Google is to receive roughly 1.9 billion internal emails, 664 million Teams items and 91 million SharePoint and OneDrive files³⁶.

Customer profiles and lists were excluded³⁵, and a third-party de-identification agent was to process the data before transfer, overseen by a court-appointed privacy ombudsman³⁴. Unions objected that the original deal protected customers but not employees. Under the revised terms, medical examinations, payroll, drug testing, crew pairings, biometrics and union grievance filings are excluded, Google covers the cost of de-identification, and Google must publicly commit "not to intentionally or knowingly reidentify the data"³⁶. More than 120 US lawmakers had written to Google and Spirit on 8 October³⁹. As of 12 November 2026 the sale still awaits court approval, with a hearing set for 17 November 2026³⁶.

What it does not show:

• A UK process. In England and Wales a liquidator may exercise the Schedule 4 powers without first seeking sanction, although in a court winding up the court keeps control^3,4. An administrator holds the Schedule 1 powers from appointment, with disposals subject to any regulations made under the Act⁶. Neither route provides for a privacy ombudsman like the one overseeing Spirit's sale³⁴, so the privacy assessment falls to the office-holder, working through the ICO's code¹².
• A price for a 20 to 250 person company. Spirit was an airline with decades of records³⁵.
• A UK privacy standard. William Fry notes that keeping links between records, which makes the data useful, also raises re-identification risk³⁴, and Bloomberg Law reported gaps in employee protections³⁷.
• Who benefits. Proceeds typically go to senior creditors and investors, not employees³⁸.

This section reflects reports published up to 12 November 2026.

What differs in Scotland and Northern Ireland?

The powers are similar, but the procedures, rules and some guidance differ, so check local requirements before relying on this guide.

• Scotland. Schedules 1 and 4 of the Insolvency Act extend to Scotland^1,2, and Schedule 1 adds Scots wording: sale "by public roup or private bargain"¹. A separate SIP 9 (Scotland), effective 1 April 2021, covers the Insolvency Act 1986 and the Bankruptcy (Scotland) Act 2016²⁹. This guide does not cover the Scottish rules on records or court involvement, so take Scottish legal advice on those points.
• Northern Ireland. The Insolvency (Northern Ireland) Order 1989 gives a liquidator "power to sell any part of the company's property", exercisable without sanction in any winding up⁴⁰, and an administrator a matching power⁴¹. The legislation site lists 2026 amendments to the Order not yet applied⁴⁰. Check which version of SIP 9 applies in Northern Ireland, and whether those amendments affect your case, before relying on this guide.

Handling a case now? We can help with preservation, inventory, buyer approaches and the disclosure note. See our service for realising data assets in liquidation or book a 30-minute case call.