Insolvency Data: Digital Records in Liquidation for Insolvency Practitioners

Every insolvent company leaves behind digital data: file servers, cloud drives, email accounts, collaboration workspaces, project software and accounting systems. For insolvency practitioners, that insolvency data raises two separate questions. What must be preserved to meet statutory and investigative duties? And could any of it be realised for the benefit of creditors? This guide is a practical framework for both.

Why digital records need early attention

Paid-for systems stop working when the bills stop. Microsoft 365 and Google Workspace tenants, hosted servers, CRMs and project platforms are usually on monthly subscriptions. After cancellation there may be a short grace period before deletion. Once data is gone it cannot be recovered. Decisions made in the first days of an appointment can decide whether any value survives.

Identify the systems

Ask the directors and any IT provider for a full list, including:

• file servers and NAS devices, on site or hosted
• Microsoft 365 or Google Workspace, including SharePoint, OneDrive and shared drives
• email accounts and shared mailboxes
• Microsoft Teams or Slack workspaces
• project and job-management software such as Asana, Jira or Procore
• CRM, quoting, ERP and accounting systems
• CAD, BIM and PDM vaults
• website, ecommerce and marketing platforms

Record the administrator credentials, the subscription owner, the renewal dates and the approximate data volumes.

Preserve

Secure access

Change administrator passwords, remove departing staff access and enable audit logging where possible.

Continue or export

Decide quickly whether to continue critical subscriptions or take complete exports. Exports should keep metadata such as timestamps, authors and folder structures.

Document

Keep a log of what was preserved, when and by whom.

Assess

Once the data is safe, consider whether any of it has realisable value.

Ownership

Is the data the company's property? Watch for client-owned designs, licensed content and data held for group companies.

Personal data

The office-holder must still comply with UK GDPR. Identify personal and special category data, and consider whether anonymisation is feasible. See anonymising data before a sale.

Contractual restrictions

Confidentiality clauses and NDAs may limit reuse.

Suitability

Linked, time-stamped operational records are more likely to interest data buyers than scattered files.

Routes to realisation

• Sale with the business: customer and operational data transferred to a purchaser of the business or its assets.
• Licensing: granting a defined use of anonymised operational records to a data buyer, such as an AI developer. Our guide to selling data to AI companies explains this market.
• Secure destruction: where data has no lawful or economic use, and retention duties are met.

Our article on data valuation covers what drives value.

Common pitfalls

• Letting subscriptions lapse before deciding
• Exporting files without their metadata
• Treating pseudonymised data as anonymous
• Selling customer contact lists without considering PECR

How McKays works with office-holders

McKays works alongside insolvency practitioners. We start with a non-confidential description of the systems involved and say plainly whether we see a responsible route. See for advisers and our sector guides.

Working with the directors and IT providers

Directors and outsourced IT providers often hold knowledge that is not written down anywhere: which server held which projects, where old email was archived, which cloud accounts were opened by individual staff. Early interviews can save significant time. Useful questions include:

• Which systems were used day to day, and which only occasionally?
• Were any systems replaced, and were the old ones migrated or left running?
• Did staff use personal accounts or devices for company work?
• Are any systems administered by a third party who invoices separately?
• Is there a backup service, and where are its copies held?

Answers to these questions often reveal data stores that would otherwise be missed, such as an old on-premises server or a backup subscription that still holds years of history.

Retention and investigation come first

Nothing in a realisation exercise should compromise the office-holder's investigatory duties or statutory retention requirements. A sensible order is to preserve everything first, complete any review required for investigations, and only then consider licensing or sale. Keep a clear separation between the preserved evidential copy and any working copy prepared for a buyer. Make sure that anonymisation or filtering is applied only to the working copy.

A checklist for the first week of an appointment

• Confirm who holds administrator rights for every cloud tenant and domain.
• Get the subscription renewal dates and suspend any automatic deletion.
• Take a forensic or full export of priority systems.
• Record the chain of custody for each export.
• Identify systems that hold special category data, such as HR or health records, and restrict access to them.
• Note any third-party hosting contracts that need notice or payment.

Taking these steps early keeps every option open, including later realisation.

Questions an insolvency practitioner may ask

• Was the database built by the company, or bought in from a list provider with its own restrictions?
• Are there outstanding subject access or erasure requests?
• Has there been a data breach that affects the database?
• Are any customers' details held under a contract that requires return or deletion on termination?

FAQ

Is company data an asset in liquidation?

Data held by the company can form part of its assets, subject to ownership, contracts and data-protection law.

Does UK GDPR apply to liquidators?

Yes. An office-holder processing personal data must comply with UK GDPR and the Data Protection Act 2018.

Should I keep paying for cloud subscriptions?

Where there is a realistic prospect of value, or a retention duty, continuing a subscription for a short period is often cheaper than losing the data.

What information does McKays need?

A description of the systems, their date ranges, rough sizes and any known restrictions. No files and no personal data.

Can data be sold separately from the business?

In some cases, particularly anonymised operational records licensed for a defined use. Take advice on each case.