This page sets out what official sources, buyers and the press say about a company's records when it sells them, closes or enters insolvency. It is for owners and for insolvency practitioners.
Does data protection law apply to a sale of records?
Records that name people contain personal data, so UK data protection law applies when they change hands. The ICO's data sharing code says a buyer's due diligence includes “establishing the purposes for which the data was originally obtained”. [1]
Does replacing names with codes take records outside data protection law?
No. Replacing names and contact details with codes is pseudonymisation. The ICO says: “Pseudonymised data is personal data in the hands of someone who holds the additional information.” [3]
How many companies does this concern?
England and Wales had 1,946 company insolvencies in August 2026. [6]
| Type | Number |
|---|---|
| Creditors' voluntary liquidations | 1,431 |
| Compulsory liquidations | 314 |
| Administrations | 182 |
| Company voluntary arrangements | 19 |
In the 12 months to August 2026, 50.1 in every 10,000 companies became insolvent.
Where are new appointments published?
In The Gazette. [7] The relevant notice codes are:
- 2410: appointment of administrators
- 2443: appointment of liquidators (creditors' voluntary liquidation)
- 2454: appointment of liquidators (winding up by the court)
- 2452: winding-up orders
Is business data being sold in insolvency?
In the US, yes. In August 2026 Google won the auction for Spirit Airlines' business data ($10 million) in its Chapter 11 case. As of 15 October 2026 the sale was still awaiting court approval. The hearing was adjourned to 6 November. [8]
Who buys company data for AI training?
AI developers and the companies that supply them. SimpleClosure, a US firm that winds down start-ups, says buyers “can include AI labs, model developers, and other companies looking for real-world code, specialized datasets, and business workflows to support AI training”. [9]
micro1, an AI-data company, announced on 9 October 2026 “a commitment to spend $1 billion over the next 12 months acquiring and licensing enterprise operational data”. [10] According to The Next Web, micro1 wants “standard operating procedures, knowledge bases, internal documents, CRM data, project histories and quality assurance processes”, targets companies with “more than 30 employees” and gives “priority to US companies, then other Western markets”. [11]
How do buyers set a price?
micro1 says payment “depends on the quality, uniqueness and value of the data”. [11] SimpleClosure lists “quality, differentiation, usability, scale, scarcity, and demand”. [9]
In April 2026 Gizmodo, citing Forbes, reported that SimpleClosure had processed nearly 100 such deals in a year, with “payouts ranging from $10,000 to $100,000 per company”. [12]
What should a company check before selling its records?
Six questions to answer first, from ICO guidance:
- Which lawful basis applies? “You must have a lawful basis to use people's information.” For legitimate interests, “you must consider people's reasonable expectations”. [13]
- Is the new purpose compatible? “You must only reuse the personal information for a new purpose if this is compatible with your original purpose.” [14]
- Have staff and customers been told? “You must bring any new uses of an individual's personal data to their attention before you start the processing.” [15]
- Is there special category data? Even a broken leg counts as “data concerning health”. [16] Reusing such data needs “a condition for processing under article 9”. [14]
- Will anyone outside the UK receive or see it? The rules cover data sent or “made accessible” outside the UK, and every “restricted transfer must be covered by” adequacy regulations, appropriate safeguards or an exception. [17]
- Do contracts or confidentiality limit sharing? The ICO asks private organisations to check their “legal agreements” and “the common law duty of confidentiality”. [18]
If you're the administrator or liquidator
The court cases in this section are from England and Wales.
Can records be sold in an insolvency?
The ICO's code recognises that “on insolvency, data might be sold as an asset to a different legal personality”. [1]
Who controls the data once an administrator or liquidator is appointed?
In Re Southern Pacific Personal Loans (2013), decided under the Data Protection Act 1998, the High Court held that the liquidators were “not data controllers” for “the data processed by the company prior to its liquidation”. The court said that in exercising rights over that data, the liquidators “would be acting as the agents of the company”. [2]
In Green v SCL Group (2019), which also concerned the 1998 Act, the High Court cited that case and said: “The office holder will only become a ‘data controller’ if he takes decisions about the processing of the data as principal in his capacity as liquidator (or administrator) rather than as agent of the company.” [19]
The professional bodies' joint FAQs from 2018 say the company “is likely to be the data controller for any pre insolvency records”. They add: “As agent of a company, IPs still need to take an informed view of data risks as they must ensure the company's compliance with its obligations.” [20]
In its passage on data that changes hands in a takeover or on insolvency, the ICO's data sharing code says: “You might be an insolvency practitioner or other adviser taking the role of controller for the time being, or advising a different controller.” [1]
What did the professional bodies say about selling a database?
In 2018 ICAEW, the IPA, ICAS, ACCA and R3 issued joint FAQs on the GDPR for insolvency practitioners. Their answer on selling a company database begins: “GDPR won't stop you selling a database of customers or an in-house list of those who have registered on a website but you should ensure that the company has records of what individuals have consented to, including what they were told, and when and how they consented.” They said a seller should check “whether the database to be transferred will be used for the same or a similar purpose by the purchaser, as the purchaser can only use the data for the purposes for which it was originally collected”. They went on: “If the buyer wants to use the data for a new purpose then it will need to obtain the consent of the individuals on the database.” [20]
The FAQs predate the Data (Use and Access) Act 2025. Among other changes, it added two provisions to the UK GDPR, both fully in force since 5 February 2026. Article 8A sets out how to decide whether a new purpose is compatible with the original one. Article 5(3) says: “For the avoidance of doubt, processing is not lawful by virtue only of being processing in a manner that is compatible with the purposes for which the personal data was collected.” [21]
Have regulators warned about selling data in insolvency?
Yes. In 2020 the FCA, ICO and FSCS said some insolvency practitioners and authorised firms had “attempted to sell clients' personal data to claims management companies (CMCs) unlawfully”. [5]
They said the terms of a standard contract “are highly unlikely to constitute sufficient legal consent for personal data to be shared with CMCs to market their services, and may not be lawful”, and that “CMCs seeking to rely on legitimate interest grounds for processing such data are highly unlikely to meet the requirements of the GDPR”. [5]
How long do the records survive?
HMRC's guidance says a liquidator may destroy the company's records “one year after the date of dissolution”. [4]
The professional bodies' joint FAQs from 2018 add that in compulsory liquidations in England and Wales, the office holder can, “on the authorisation of the Official Receiver, sell, destroy or otherwise dispose of the entity's records at any time”. [20]
What Bayeset does
Bayeset, based in Munich, buys copies of business records (emails, quotes, project files, tickets, CRM) and prepares them for AI developers. Names and contact details become codes, and the records remain personal data.
We can also find you a buyer. Some buyers pay us a referral fee for introducing you. You never pay us anything.
If you're an administrator or liquidator, see how we buy from companies in administration or liquidation.
Find out if your records could sell contact@bayeset.com
Sources
- ICO, Data sharing code: due diligence after mergers and acquisitions. Page dated 6 Dec 2024; under review after the Data (Use and Access) Act 2025.
- Re Southern Pacific Personal Loans Ltd [2013] EWHC 2485 (Ch), paras 34 and 35.
- ICO, Pseudonymisation. Page dated 10 Oct 2025; under review.
- HMRC, Insolvency practitioner's handbook, ch. 19. Published 19 Dec 2025; chapter unchanged since.
- FCA, ICO and FSCS joint statement, 7 Feb 2020.
- Insolvency Service, Company insolvencies August 2026. Published 18 Sep 2026.
- The Gazette, notice codes.
- In re Spirit Aviation Holdings, No. 25-11897 (Bankr. S.D.N.Y.), Dkt. 1695, via Stretto case update, 14 Oct 2026.
- SimpleClosure, AssetHub, FAQ. Undated; accessed 19 Oct 2026.
- micro1, “micro1 Announces $1 Billion Enterprise AI Data Commitment”, press release via Business Wire, 9 Oct 2026.
- The Next Web, “micro1 commits $1bn to buy company data for training AI agents”, 9 Oct 2026.
- Gizmodo, “Failed Companies Are Selling Old Slack Chats and Email Archives to Train AI”, 17 Apr 2026, citing Forbes.
- ICO, Legitimate interests. Last updated 23 Mar 2026.
- ICO, Principle (b): Purpose limitation. Updated 23 Mar 2026.
- ICO, The right to be informed. Undated; under review after the Data (Use and Access) Act 2025; accessed 19 Oct 2026.
- ICO, What is special category data? Updated 9 Apr 2024; under review after the Data (Use and Access) Act 2025.
- ICO, A brief guide to international transfers. Published 15 Jan 2026.
- ICO, Data sharing code: lawfulness. Undated; under review after the Data (Use and Access) Act 2025; accessed 19 Oct 2026.
- Green v SCL Group Ltd [2019] EWHC 954 (Ch), para 71. Judgment of 17 Apr 2019.
- ICAEW, IPA, ICAS, ACCA and R3, “FAQs on the GDPR: Practical considerations for insolvency practitioners (IPs)” (PDF), pp. 5 and 9. 2018; ICAEW copy reformatted 5 June 2018; accessed 19 Oct 2026.
- Data (Use and Access) Act 2025, s. 71, inserting Articles 5(3) and 8A into the UK GDPR. Fully in force 5 Feb 2026 (S.I. 2026/82).