Customer data in an insolvency asset sale: privacy and contract transfer

A customer contract, an open claim and the related data set are connected but not identical assets. Whether a contract transfers depends on transaction structure, contract and applicable rules. This does not automatically permit transfer of every historic customer record.

The article on an ongoing contract in insolvency explains reciprocal performance and the choice under section 21 IO. The data set requires a separate GDPR review.

Create three lists: contracts transferred or continued, legacy positions only to be wound down and persons without an active contract. Assign purpose, data scope and legal basis separately.

Article 6 GDPR requires at least one legal basis for each processing operation. Depending on purpose, contract performance, legal obligation or legitimate interests may be relevant. None applies automatically to the entire acquired database.

If the buyer intends a different purpose, Article 6(4) GDPR requires a compatibility assessment absent consent or specific legislation. Connections between purposes, context, data nature, consequences and safeguards are among the factors.

Special categories under Article 9 GDPR need an additional exception. Health, biometric or other sensitive information should not remain hidden in a general customer export.

Article 5 GDPR requires purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality. These principles apply before completion. The due diligence data room should contain only what the specific review needs.

Where possible, potential buyers should first receive aggregated, pseudonymised or redacted material. Names, private contact details and free-form notes are often unnecessary in full for economic evaluation.

The acquisition from insolvency hub places the data room, acquisition perimeter and approval chain in context.

Where the buyer obtains data from the acquired pool rather than directly from the individual, Article 14 GDPR generally applies. Information includes controller, purposes, basis, categories, recipients, retention, rights and data source.

Notice is generally given within a reasonable period and at the latest within one month. Earlier timing can apply before first communication or disclosure. Article 14(5) exceptions require a specific assessment.

Data collected directly by the new controller follows Article 13 GDPR. New purposes need notice before the corresponding further processing unless an exception applies.

A customer record includes more than contact details. Objections, consent status, suppression flags, deletion dates and source information are essential for lawful use and must not be lost in export.

Article 21 GDPR is clear for direct marketing. After an objection, data cannot be processed for that purpose. The buyer needs effective suppression lists and must highlight the right to object no later than the first communication.

Article 32 GDPR requires risk-appropriate security. Encryption, role-based access, logging, secure key delivery, recovery and deletion of intermediate copies belong in the handover plan.

Section 117 IO can require approval by the creditors committee and insolvency court for the sale of the business, all movable fixed and current assets or an operationally necessary part. The intended sale must be publicly announced.

That approval concerns the insolvency transaction. It does not identify data controllers or replace legal basis, notice and security. Both workstreams must meet before data access.

The insolvency estate describes the asset framework. Personal data remains regulated information when the underlying business is realised.