Company records in insolvency: a guide for UK office-holders

Most estates have an asset that never appears on the statement of affairs: the company's records. Years of email, team chat, documents, code and project history now have buyers, because AI developers pay for real examples of how skilled work gets done.

This guide is for UK liquidators, administrators and their advisers. It covers why records now have value, the power to realise them, the timing risk, the data protection position and the lessons from the first large court-supervised sale. For the wider market, see our UK guide to selling company data.

This guide is general information, not legal advice.

Why records are now an asset

The clearest precedent is Spirit Airlines. The airline stopped flying in May 2026. In August, Google won a US bankruptcy auction for its corporate records with a $10m bid, ahead of a $7.5m bid from the AI data company Mercor. The records included about 100 million emails, 500 million Microsoft Teams messages and about 30 million lines of code. Another buyer, micro1, then made a late offer, reported at $12.5m.

Smaller estates are selling too. In the US, SimpleClosure, which helps startups wind down, has handled more than 150 deals through its platform for selling the assets of closing companies. Most of those companies were far smaller than an airline. For the range of prices reported so far, see what company data is worth.

UK practice is newer, and few UK deals have been made public. That gives office-holders who move first a real advantage, and creditors a return they would not otherwise see.

The power to realise records

A liquidator has power to sell "any of the company's property" by public auction or private contract. An administrator has the equivalent power to sell or otherwise dispose of the company's property.

What is sold in practice is usually a licence: the right to use a de-identified copy of agreed records for agreed purposes, together with the rights the company holds in that material. Those rights can include copyright, because a company is normally the first owner of copyright in work its employees create in the course of their employment (section 11 of the Copyright, Designs and Patents Act 1988).

Not everything in the systems belongs to the company. Material written by clients and suppliers may be theirs, and some will be covered by confidentiality agreements. In the Spirit sale, a software supplier argued that its vendor data was not estate property and asked for it to be found and excluded, and other suppliers moved to enforce their confidentiality agreements. Expect the same questions here, and scope the deal to avoid them.

Timing: act early in the appointment

Records have a shelf life, and it is shorter than most appointments.

• Cloud accounts are deleted. After a Microsoft 365 business subscription is cancelled, Microsoft says data might be deleted after 90 days and will be deleted no later than 180 days after. Other providers have their own windows, and some are shorter.
• Dissolution ends the opportunity. When a company is dissolved, its remaining property is deemed bona vacantia and belongs to the Crown, unless the company is later restored to the register.

In practice, that means securing the admin logins on day one, stopping any automatic deletion, keeping the minimum licences needed to preserve the records, and deciding early whether the records are worth marketing.

Data protection: who is responsible

Business records are full of personal data, so UK GDPR applies to any sale.

On the office-holder's own position, the case law is reassuring but not absolute. In Southern Pacific Personal Loans [2013] EWHC 2485 (Ch), the court held that liquidators were acting as agents of the company, not as controllers. In Green v Group Ltd [2019] EWHC 954 (Ch), the court said an administrator is not automatically a controller, provided they do not take decisions as principal. The company remains the controller, and the sale still has to meet UK GDPR.

Regulators watch sales of personal data in insolvency closely. In February 2020, the FCA, ICO and FSCS issued a joint statement after some insolvency practitioners and firms tried to sell clients' personal data to claims management companies unlawfully. A records licence is a very different transaction, but the message holds: do it properly, and document it.

For a records licence, that means:

1. A lawful basis. Normally legitimate interests, supported by a written assessment.
2. A compatibility assessment. The records were collected to run the business. Using them for a new purpose needs an assessment of the link between purposes, people's reasonable expectations, the nature of the data, the consequences and the safeguards. Article 8A of UK GDPR sets out these factors, and the ICO's March 2026 guidance explains them.
3. Exclusions. HR, payroll, health, disciplinary, client personal data and privileged material stay out.
4. Real de-identification. The ICO's guidance is clear that pseudonymised data is still personal data, and that identifiability depends on the means reasonably likely to be used. Test the result against a "motivated intruder".
5. Buyer terms. No re-identification, limits on onward transfer, security standards and deletion on request.
6. Transfer safeguards. For US buyers, confirm certification under the UK-US data bridge, or use the International Data Transfer Agreement.
7. A data protection impact assessment where the risk is high, which it often will be for large email and chat archives.

Our UK guide covers each of these in more detail.

Lessons from the Spirit Airlines sale

The Spirit sale is the most closely watched test so far of a records sale under court supervision. As of 14 October 2026, the hearing had been adjourned five times and was set for 6 November 2026. Six lessons stand out for UK office-holders:

1. Customer data came out. Passenger databases, booking and transaction records, refunds, inflight purchases and WiFi sales were all excluded from the deal.
2. De-identification is to be independent and certified. Spirit has hired a specialist firm, Tonic.ai, to de-identify the remaining records. Under the proposed terms, Tonic.ai must file a certification with the court before each transfer, and the ombudsman asked that it also state how many passengers' details it found and removed.
3. The buyer promised not to re-identify anyone, and any onward recipient must make the same promise.
4. Employee data was the flashpoint. Unions objected, and 119 US lawmakers asked for sensitive employee data, such as medical, disciplinary and pay records, to be excluded before any transfer.
5. Third parties will assert rights. Suppliers claimed ownership of their data and enforced confidentiality agreements.
6. The buyer's own record matters. The court-appointed privacy ombudsman asked to investigate one bidder's security incident if it became the buyer, and to review another's plan to de-identify the data itself.

UK insolvency has no direct equivalent of the US consumer privacy ombudsman, so these judgements fall to the office-holder and their advisers. The simplest way to avoid Spirit's delays is to make these decisions before marketing the records, not after.

A checklist for office-holders

1. Secure admin access to every system: email, chat, file storage, code hosting, project tools and CRM.
2. Stop automatic deletion, and keep the minimum subscriptions needed to preserve the records.
3. Record what exists: systems, years of history, headcount and data volume.
4. Identify what must be excluded: HR, health, client personal data, privileged and restricted material.
5. Review client and supplier contracts for confidentiality and ownership terms.
6. Complete the legitimate interests and compatibility assessments, and a DPIA where needed.
7. Set the de-identification standard, and require a sample for review before completion.
8. Vet buyers on transfer safeguards, security record and no re-identification terms.
9. Seek competing written offers.
10. Complete before dissolution, and report the realisation to creditors.

How TydeX works with office-holders

TydeX acts as agent to the office-holder. We identify what exists, present the company's records to vetted buyers, negotiate terms and bring you written offers to accept or reject. We supply each buyer's privacy terms for your solicitor to review. The buyer handles the export and de-identification under the contract you approve, and we never hold the records.

Our fee comes from realisations, so there is nothing for the estate to fund. Refer a case and we will tell you quickly whether the records are worth marketing.