A UK administrator or liquidator may sell or license an insolvent company's data, including to AI buyers, because the Insolvency Act 1986 gives both office-holders the power to sell company property by public auction or private contract, but personal data in the sale stays subject to the UK GDPR.
During an administration the company itself stays the data controller while the administrator acts as its agent. This page sets out the powers, the data-protection limits, a US comparison, buyer programs as dated claims and the option not to sell, as one office-holder route in AI training data licensing. DataPacts is not a broker and takes no cut of any sale.
The statutes, guidance and program pages below were checked against their primary sources, under the rules on how we source, date and check every figure.
Who Holds the Power to Sell Company Data in a UK Administration or Liquidation
In a UK administration the administrator holds the power to sell company property, data included, and in a liquidation the liquidator holds the same power, in each case by public auction or private contract. The Insolvency Act 1986 (c. 45) has been in force since 1986-12-29 (s.443), and Schedule B1, inserted by the Enterprise Act 2002, has applied since 2003-09-15. Paragraph 59 of Schedule B1 lets the administrator do anything necessary or expedient for managing the affairs, business and property of the company.
The table compares the four provisions as of 2026-11-09.
| Provision | Who | What it allows | In force | Source |
|---|---|---|---|---|
| Sch B1 para 59 | administrator | anything necessary or expedient for the management of the company's affairs, business and property | since 2003-09-15 (Sch B1 inserted by the Enterprise Act 2002) | legislation.gov.uk |
| Sch B1 para 60 with Sch 1 para 2 | administrator | sell or otherwise dispose of company property by public auction or private contract | since 2003-09-15 | legislation.gov.uk |
| Sch B1 para 69 | administrator | acts as the company's agent, so the company stays the data controller | since 2003-09-15 | legislation.gov.uk |
| Sch 4 para 6 | liquidator | sell company property by public auction or private contract | Act in force 1986-12-29 (s.443) | legislation.gov.uk |
Insolvency Act 1986 (c. 45). The Act does not name data; the power covers company property, which includes data assets.
A data archive therefore sits within the power of sale as company property, and the Act is the only authority this page cites for the power itself. Whether a given sale needs a court, creditor or other approval is not stated here, either way, and is a question for the office-holder's advisers.
Why the Company Stays the Data Controller While an Administrator Sells
Under Insolvency Act 1986 Sch B1 para 69 the administrator acts as the company's agent, so the company, not the administrator, remains the data controller for the personal data it holds. The controller's duties under the UK GDPR therefore stay with the company during the sale. The Information Commissioner's Office (ico.org.uk) is the UK data protection authority that oversees them.
UK regulators follow estate data sales: the ICO co-signed the joint letter of 2025-04-28 on the 23andMe bankruptcy, which Canada's Office of the Privacy Commissioner published. The agency rule is recorded here for administrators only; the controller position of a liquidator is not stated. A buyer that receives personal data becomes responsible for its own processing under the UK GDPR.
UK GDPR Limits on Selling Personal Data From an Insolvent Company
Personal data in a UK estate may be sold only within the UK GDPR, which the Data (Use and Access) Act 2025 amended: since 2026-02-05, processing for a new purpose that is compatible with the original one is not lawful by that fact alone. The UK GDPR is Regulation (EU) 2016/679 as it forms part of UK law, and the Act (c. 18) received Royal Assent on 2025-06-19. Sections 67, 70 and 71 came into force on 2026-02-05 under S.I. 2026/82. Section 71 rewrites purpose limitation in Art. 5(1)(b) and 5(3), and it covers data collected from the data subject or otherwise.
Section 70 adds recognised legitimate interests, Art. 6(1)(ea), only where a condition in Annex 1 is met. The Annex 1 headings include disclosure for Art. 6(1)(e) purposes, national security, emergencies, crime and safeguarding vulnerable individuals; none of them names a sale of data. Section 67 places research that is publicly or privately funded, commercial or non-commercial, including technological development, inside "scientific research". That concerns the buyer's purpose, not the estate's right to sell.
Staff records in workplace archives are personal data too, and transfers outside the UK need their own route. The rules by country are set out under employee data and AI training rules.
Data Taken by Directors or Staff: The Section 170 Offence
Under Data Protection Act 2018 s.170(1), in force since 2018-05-25, it is an offence to knowingly or recklessly obtain or disclose personal data without the consent of the controller, to procure its disclosure, or to retain it after obtaining it. In an insolvency this matters because directors or staff who copy customer or workplace data from a failing or closed company to sell it themselves, without the company's consent as controller, risk this offence. During an administration the administrator manages the company's affairs, business and property under Sch B1 para 59.
The lawful route runs through the office-holder and the company as controller. This page does not describe penalties or statutory defenses.
How the UK Route Compares With a Section 363 Sale
A UK office-holder sells under a statutory power of sale while the company stays controller, whereas a US estate selling outside the ordinary course needs notice and a hearing under 11 U.S.C. 363(b)(1) and, where its privacy policy restricts transfers, a consumer privacy ombudsman.
The table compares the two routes as of 2026-11-09.
| Point | UK administration or liquidation | US section 363 sale | Source |
|---|---|---|---|
| Who sells, on what basis | administrator or liquidator under the power of sale (IA 1986 Sch B1 para 60, Sch 1 para 2; Sch 4 para 6) | trustee or debtor in possession, outside the ordinary course after notice and a hearing (11 U.S.C. 363(b)(1)) | legislation.gov.uk; law.cornell.edu |
| Personal data | company stays controller (para 69); UK GDPR as amended by the DUAA 2025 | where the privacy policy restricts transfer: consistent sale, or consumer privacy ombudsman (11 U.S.C. 332) and court approval | legislation.gov.uk; law.cornell.edu |
| Regulator named on this page | Information Commissioner's Office | Federal Trade Commission, FTC Act s.5 (15 U.S.C. 45) | ico.org.uk; govinfo.gov |
The Spirit Airlines chapter 11 (Bankr. S.D.N.Y. 25-11897 (SHL)) is the dated contrast: at the 2026-08-14 auction Google LLC was the successful bidder at USD 10,000,000 and Mercor.io Corporation the alternate bidder at USD 7,500,000, the sale is not approved as of 2026-11-09, and the hearing is set for 2026-11-17. The full treatment is in US bankruptcy data sales under section 363.
Buyer Programs That Name the UK or an Office-Holder Signature
Three buyer programs state on their own pages that they take UK records or deals signed by a liquidator or administrator; each statement is the buyer's claim, checked 2026-11-09.
The table lists them alphabetically, as of 2026-11-09.
| Program | What its own page states about the UK or office-holders | Terms relevant to an estate | Checked | Source |
|---|---|---|---|---|
| micro1 company data partnerships | FAQ: demand strongest in the US, UK and Canada; US companies prioritized; referral page lists defunct partnerships in "10+ Countries" | 30+ full-time employees; data primarily in English | 2026-11-09 | micro1.ai/data-partnerships |
| Ooak Data partner program | wind-down deals closed with a director, liquidator or administrator signing; EU partner data processed and stored in the EU via Ooak Data SAS | raw data deleted within 30 days of delivery with written confirmation; training use only | 2026-11-09 | ooakdata.com/partner; ooakdata.com/legal |
| Turing Project Lazarus | active, winding-down or wound-down companies; strongest demand US, UK, Canada and EU | non-exclusive license to sell; Turing the only seller for the first 90 days; revenue share, nothing upfront; Turing covers de-identification costs | 2026-11-09 | lazarus.turing.com |
None of the three is endorsed or ranked. Turing states that it licenses records non-exclusively and sells them, and each program's terms can change. The full dated terms sit in the AI data partnership payouts and program terms compared.
Selling an Insolvent UK Company's Data or Not: Benefits, Risks, Downsides and Alternatives
For an administrator or liquidator, a data sale can add realizations for creditors, but personal data, staff records and third-party content limit what can be sold, and leaving the data unsold is a valid outcome.
Benefits
- An asset that may not appear on the balance sheet can be offered by public auction or private contract.
- Buyer programs state that they take wind-down records signed by an office-holder.
- De-identified sets reduce the personal data that moves; Turing states that it covers de-identification costs.
Risks
- Processing for a new purpose is not lawful merely because it is compatible with the original one.
- People who take data outside the office-holder's process risk the s.170 offence.
- Regulators watch estate data sales, as the ICO's role in the 23andMe letter shows.
- Third-party works in an archive need their own license: CDPA 1988 s.29A exempts only non-commercial research, and an estate can license only what the company owns.
Downsides
- Preparing, de-identifying and reviewing data costs time and money that cannot be quantified for UK estates here.
- Buyer terms are claims that can change.
- Accounting records must still be kept after a sale: 3 years for a private company and 6 for a public one under Companies Act 2006 s.388(4), subject to insolvency rules (s.388(5)). The gov.uk guidance, as of 2026-11-09, says to keep company records for 6 years and names a fine of GBP 3,000.
Alternatives
- Not selling: keep the records for their retention periods, then delete them.
- Selling the business or other assets without the personal data.
- Licensing non-exclusively, as Turing states for Project Lazarus.
- If the company is dissolved instead, its remaining property is bona vacantia under Companies Act 2006 s.1012, and the Bona Vacantia Division, for England and Wales, states that it normally disclaims an asset or sells it for full market value; see who owns a dissolved company's data.
DataPacts takes no position on whether an estate should sell; the decision belongs to the office-holder and, where the law requires, the creditors or the court.
From Appointment to Delivery: Steps for an Administrator or Liquidator Selling Data
A UK office-holder's data sale runs from an inventory of what the company holds to a decision on personal data, a sale by auction or private contract, and delivery of only what the buyer may lawfully receive.
- Inventory systems, data types and the privacy notices given to customers and staff.
- Separate personal data from business records and check the purpose against UK GDPR Art. 5(1)(b) as amended.
- Decide what leaves the estate in identifiable form and what is de-identified first, using the rules on PII removal and de-identification.
- Offer the data by public auction or private contract.
- Contract the licensed scope, deletion and no onward transfer beyond the agreed uses.
- Deliver, and keep the records the company must retain.
A winning bid or signed heads of terms is not completed delivery; Spirit shows the gap in another jurisdiction. Sanction and approval rules for a specific sale are checked with the office-holder's advisers.
Where UK Office-Holder Data Sales Connect to Other Pages
This page covers the UK office-holder route; the pages below cover the other jurisdictions, the UK law pages, the seller process and the buyers.
- Parent: data assets in insolvency in every jurisdiction
- The office-holder's role: insolvency administrators and liquidators as data sellers
- Records: record retention after closing a company
- UK law: UK rules for licensing data for AI training outside insolvency
- Personal data: UK GDPR after the Data (Use and Access) Act 2025, in full
- Third-party works: UK copyright and AI training for an archive
- Outside insolvency: selling data from a shut-down or defunct company
- Transfers and contracts: selling data to AI companies from outside the US
- The general decision: should you sell or license your data
- Buyers: who buys AI training data
- Referral limits: referral programs of AI data buyers
- Law: AI training data law by jurisdiction
This page is information, not legal advice.
Frequently Asked Questions
Can an administrator sell a company's customer database?
Yes: an administrator may sell company property by public auction or private contract (Insolvency Act 1986 Sch B1 para 60, Sch 1 para 2). The company stays the controller (para 69), and personal data must meet the UK GDPR as amended by the Data (Use and Access) Act 2025.
Can directors sell company data once the company is insolvent?
Once an administrator is appointed, the administrator manages the company's affairs, business and property (Sch B1 para 59). Taking personal data to sell without the controller's consent risks an offence under Data Protection Act 2018 s.170.
What happens to company data if a UK company is dissolved without a sale?
Its remaining property becomes bona vacantia and vests in the Crown (Companies Act 2006 s.1012). Restoration is possible within 6 years (ss.1024, 1030), and in England and Wales the Bona Vacantia Division normally disclaims an asset or sells it for full market value.