Selling a company's data in UK administration or liquidation

Yes: an administrator or a liquidator can license or sell a UK company's data to an AI buyer, because the company's rights in its records (their copyright, database right and confidential information, and the media they sit on) are its property, and the Insolvency Act gives an administrator the power to sell or otherwise dispose of the property of the company and a liquidator the power to sell any of the company's property by public auction or private contract. The office-holder signs for the company, which stays the licensor: an administrator acts as its agent, and a liquidator may sign documents in the name and on behalf of the company. What the Insolvency Act does not do is set aside data protection law. The people named in the records (staff, customers, contacts) are still protected by UK GDPR, and the regulator's own reading is that a very different, unexpected use of their information is likely to need specific consent. So the records that sell are de-identified first. Once the company is dissolved, everything it owned passes to the Crown as bona vacantia: the Crown may deal with it, but the former directors and liquidators can license it for the company only once it is restored to the register.

This guide is for insolvency practitioners, the directors of a company heading into administration or liquidation, and their advisers. It sets out who can sign, what counts as the company's data, what UK GDPR still asks, what buyers pay and how a sale runs, and the order of steps that keeps the records sellable. It is research from public sources, not legal advice: an office-holder takes their own advice on any sale. For a UK company that is still trading, read can a UK company sell its data to AI companies?.

Contents

1. Who can sign for the company
2. What counts as the company's data
3. What UK GDPR still asks
4. Sending records to a buyer outside the UK
5. What buyers pay, and who buys
6. The deletion clock
7. How a sale runs, step by step
8. After dissolution
9. Questions people ask

Who can sign for the company

In administration. The administrator has the powers in Schedule 1 of the Insolvency Act, applied by Schedule B1, including the power to sell or otherwise dispose of the property of the company by public auction or private contract. A licence of the company's records is a disposal of an interest in that property. In doing it the administrator acts as the company's agent, so the company is the party that grants the licence and gives its promises, not the administrator personally. A buyer dealing with the administrator in good faith and for value need not inquire whether the administrator is acting within his powers, which makes the buyer's own checks shorter: it confirms the appointment, not the scope of the powers.

In liquidation. In both a court and a voluntary winding up the liquidator may exercise any of the powers specified in Parts 1 to 3 of Schedule 4, which include the power to sell any of the company's property by public auction or private contract and to sign in the company's name. In a court winding up their exercise stays subject to the court's control. In a creditors' voluntary winding up, a liquidator the members chose cannot use these powers, except with the sanction of the court, before the creditors nominate a liquidator.

Before an appointment. The directors still run the company and can license its records like any other asset. A sale on the eve of an appointment is one to take advice on, and buyers will ask whether an appointment is coming.

After dissolution. Nobody can sign until the company is restored (see After dissolution).

What counts as the company's data

What the office-holder sells is the company's rights in its own working records (English law does not treat information itself as property, but the copyright, database right and confidential information in it, and the media, are the company's): the email, chat and documents of its staff written in the course of their work, its tickets and project files, its code and its accounting records. That is what AI buyers of company records want, because it shows how the company did its work, decision by decision. Three kinds of record need sorting before anything is offered:

• Records that belong to someone else. Work done for clients under contracts that give the client the output, records a client shared under a confidentiality term, and data a supplier licensed to the company. These stay out unless the other party agrees.
• Records about identifiable people. Personnel files, customers' accounts and payment details, health or financial information. These are the company's to hold, not to hand over as they are: see the next section.
• Records the company only licensed. Software it used under a subscription is the vendor's; what the company created inside it is the company's, and the vendor's terms decide how it can be exported.

What UK GDPR still asks

An appointment changes who acts for the company. It does not change the company's duties to the people in its records, and the UK's maximum penalty for breaching them is the higher of £17.5 million or 4% of worldwide turnover. Four parts of the law shape a sale.

A new purpose has to be compatible, or consented to. Records collected to run the business are being reused to train AI models, which is a new purpose. UK GDPR now sets out its own compatibility test, in which a controller must take into account any link between the original purpose and the new purpose, the context in which the personal data was collected, and the nature of the processing, among other things. The regulator's guidance reads such a change plainly: a purpose that is very different, unexpected, or has an unjustified impact on the people involved is likely to be incompatible, and in practice is likely to need specific consent. Consent from former staff and customers is rarely obtainable in an insolvency, which is why records sell de-identified.

Legitimate interests need necessity. The company's commercial interest in realising an asset can count, but if you can reasonably achieve the same result in another less intrusive way, legitimate interests doesn't apply. A buyer training models on how work is done can usually do so with the names removed, which makes a licence of identifiable records hard to justify under that test and a de-identified one much easier.

De-identifying is itself processing. The regulator says the anonymising step needs a lawful basis and a defined purpose, and that applying anonymisation techniques is in general likely to be fair and lawful. The office-holder records that step: what was removed, how, and who checked it.

Anonymous for the buyer is judged from the buyer's side. The same information may be personal data in your hands but anonymous in the hands of a recipient that has no access to the additional information. A company that keeps its originals still holds personal data; a de-identified lot can be anonymous in a buyer's hands if the buyer cannot reasonably identify anyone. Buyers ask for this in writing, and the regulator, in its response on training generative AI on web-scraped data, expects AI developers to evidence why other available methods for data collection are not suitable, so a documented licence from the company helps the buyer's own case too.

Sending records to a buyer outside the UK

Most of the buyers of company records we track are in the United States. Personal data can go to a US buyer without further paperwork only if the buyer is on the Data Privacy Framework List as participating in the UK Extension; a buyer certified for EU data alone does not cover UK data. For any other buyer the company chooses a safeguard (the International Data Transfer Agreement or the Addendum to the EU clauses) and completes a transfer risk assessment; without one, only Article 49's narrow derogations remain, such as each person's explicit consent to the transfer. A lot that is properly de-identified before it leaves is not personal data in the buyer's hands, which is the simpler route.

What buyers pay, and who buys

There is no published price list. The one sale of a whole company's records with public bids was a US bankruptcy: Spirit Airlines' de-identified email, documents, chats and code drew a $5 million opening bid and a $10 million winning bid at a court-supervised auction. Most companies are far smaller: the smallest sale we take on is $23,000, the weighted average of what a small company's records have sold or been offered for on record.

Buyers' published rules decide who can buy from a UK estate:

• Some take companies that are no longer trading. The General Data Company licenses industrial companies' records, including from companies that have stopped trading, and sets scope, uses and payment out in writing.
• Some put UK companies after US ones: micro1 says it is prioritizing US companies, followed by other Western markets.
• Buyers' own estimators, compared for the same company placed in different countries, offer a company in Europe, the UK or Canada 0.71 times what they offer it in the US, and our valuation applies that.

The buyer board lists every buyer we track with its rules, its terms and where it takes companies from.

The deletion clock

The records an estate can sell are only the ones that still exist. Software subscriptions are among the first costs a company in distress cuts, and each vendor then deletes on its own schedule: Microsoft keeps a cancelled tenant's data for 180 days at most and Atlassian for 60 days. So the first act is not the sale. It is an administrator's export of every system that holds the company's records, or keeping those subscriptions paid until the export is done. The deletion countdown shows each vendor's window and its source.

How a sale runs, step by step

1. Freeze and export. Stop deletions, keep the subscriptions that hold records running, and export each system with its structure (threads, folders, tickets with their history).
2. Inventory what the company owns. Separate the company's own working records from client files, licensed data and personnel files.
3. Value it before spending on preparation. A free valuation from the company's own answers, or from exports measured on the office-holder's computer, says whether the records are worth a sale: value the records.
4. De-identify, and record how. Remove or replace names and identifiers, cut out whole the files about health, finance and employees, and keep a note of the method and the check.
5. Describe it to every buyer whose rules fit at once, without naming the company. Competing interest is what moved the one public auction from its opening bid to its winning bid.
6. Sign for the company. The office-holder signs as agent; the buyer confirms the appointment and receives the de-identified lot under a licence that names the permitted uses.
7. Account for the proceeds with the company's other realisations.

When we run the sale, our fee is a share of what the buyer pays ( 12% of the first $250,000, 10% up to $1 million, 8% up to $3 million and 6% above $3 million), due only out of a completed sale, and the company stays the licensor throughout: how a sale works.

After dissolution

Once a UK company is dissolved, all property and rights whatsoever vested in it are deemed to be bona vacantia, which means they belong to the Crown. The Crown may deal with them as bona vacantia, but its former directors and its former liquidator can no longer license its records for the company. The route back is restoration, within limits. Administrative restoration through the registrar is only for a company the registrar struck off, and not after six years from dissolution; a company dissolved after a liquidation or an administration is restored only by an application to the court, subject to the same six-year limit in all but personal injury cases. A company restored to the register is deemed to have continued in existence as if it had not been dissolved, after which it can act again, through its directors or a liquidator. Whether a sale justifies the cost of restoration is a question the valuation answers first. Who owns a dissolved company's data covers the same question for the United States and Canada.

Questions people ask

Can an administrator sell the company's customer database? The administrator has the power to sell the company's property, and that includes the company's rights in a customer database (its database right and the confidential information in it). UK GDPR still applies to the customers in it: selling identifiable customer records to a new kind of buyer for a new purpose is the case the regulator says is likely to need specific consent. For AI training, buyers take the records de-identified, which is how a sale avoids that problem.

Does the buyer need to check the administrator's powers? No. A person dealing with the administrator in good faith and for value need not inquire whether the administrator is acting within his powers. Buyers do check that the appointment is real and current.

Who is the licensor: the office-holder or the company? The company. The administrator acts as its agent, and a liquidator signs in the name and on behalf of the company.

Can staff email and chat be sold? They are the company's records, written in the course of work. They name staff and the people staff wrote to, so they are de-identified before any buyer sees them, and personnel files are cut out whole.

Can the records go to a US buyer? Personal data can go without further paperwork only to a buyer on the Data Privacy Framework List participating in the UK Extension; otherwise the company uses the International Data Transfer Agreement or the Addendum with a transfer risk assessment, or, narrowly, one of Article 49's derogations. De-identified records are the simpler route.

What if the company has already been dissolved? Its property belongs to the Crown as bona vacantia, which may deal with it. For the company itself to sell, it is restored to the register first, by the court where it was wound up or left administration by dissolution.

What this means for you

An office-holder can sell a company's records like any other asset, and the buyers who pay for them are real. Three things decide whether there is anything to sell: exports taken before the vendors delete them, records sorted into what the company owns, and de-identification done and recorded before any buyer sees a file. The valuation is free, needs no upload, and tells an estate quickly whether its records are worth that work.

Value the records, read how a sale works, or see the rights a sale rests on.