← All articles

Selling Customer Data When a Company Closes: A UK Guide

When a business closes, its customer database is often one of the few assets with obvious value left. Competitors, successor businesses and data buyers may all be interested in a list of customers, their order histories and their contact details. But selling customer data is one of the most heavily regulated things a closing company can do. This guide explains what UK owners, directors and insolvency practitioners need to think about before a customer database changes hands.

What counts as customer data

A customer database is rarely a single file. In most businesses it is spread across several digital systems:

Each of these may hold personal data about individuals, such as sole traders, named contacts at business customers or consumers. It may also hold commercial information about companies. The rules differ for each, so the first step is to understand what you actually hold.

Personal data versus business data

Information about a limited company, such as its registered name, what it bought and when, is not personal data in itself. Information that identifies a living person is. That includes a named buyer's email address, a consumer's delivery address or a sole trader's phone number. Most real customer databases mix the two.

Under UK GDPR, a sale or transfer of personal data is a form of processing. It needs a lawful basis, it must be fair and transparent, and it must be compatible with the purpose for which the data was first collected.

Can a customer database be sold at all?

Often, yes, but with conditions. The ICO's guidance recognises that customer databases are commonly transferred when a business is sold or wound down. The key points are usually:

Transparency

Did your privacy notice tell customers that their data might be transferred to a buyer or successor if the business was sold or closed? If it did, a transfer is far easier to justify.

Compatibility

A buyer who will use the data for a similar purpose, such as continuing to supply the same kind of goods, is in a very different position from a buyer who wants it for an unrelated purpose.

Marketing consent

Electronic marketing is governed by PECR as well as UK GDPR. Consent given to your company generally does not carry over to a buyer for its own marketing. A buyer usually has to obtain fresh consent, or rely on a narrow exception, before emailing consumers.

Notifying customers

Even where a lawful basis exists, individuals usually need to be told who now holds their data and how to object.

The role of the liquidator

In an insolvency, the office-holder takes control of the company's assets, including its data. Liquidators remain bound by data-protection law and should take advice before realising a database. A common approach is to sell the database as part of a wider sale of the business or its goodwill, with warranties and restrictions on how the buyer will use it. Selling raw contact lists to an unconnected marketer is a different matter. See our page for insolvency practitioners and advisers for how McKays works alongside office-holders.

Separating customer data from operational data

Many closing businesses hold far more than a contact list. Order histories, quotations, service records and correspondence can describe how the business actually worked. These operational records may have a different kind of value, for example licensing to AI developers. Personal details can often be removed while the useful structure is kept. Our guide to anonymising data before a sale explains how.

Practical steps before selling customer data

  1. Map the systems. List every system that holds customer information, with its date range and size.
  2. Check the privacy notices. Find the versions that applied when the data was collected.
  3. Separate consumers from business contacts. The rules and the risks differ.
  4. Review contracts. Some business customers will have confidentiality clauses that restrict transfer.
  5. Decide the purpose. Is the buyer continuing the business, or using the data for something new?
  6. Plan notification. Draft how customers will be told and how they can object.
  7. Take advice. A data-protection specialist or solicitor should review any sale.

Keep the systems running

The most common way value is lost is simple: subscriptions lapse and data disappears. CRM accounts, cloud email and ecommerce platforms are often cancelled within weeks of closure. If there is any prospect of a sale or licence, keep the accounts active, or take complete, secure exports first. Our article on servers and email after closure covers this in detail.

How McKays can help

McKays helps UK business owners and liquidators work out whether their digital records could have a responsible licensing use. We start with a non-confidential description, so you never need to send us files or customer details. Browse the sector guides to see which records are typical in your industry.

FAQ

Is it legal to sell a customer database in the UK?

It can be, provided the transfer complies with UK GDPR and PECR. That generally means being transparent with customers, having a lawful basis and respecting marketing consent rules. Take advice on your specific circumstances.

Does a buyer get my marketing consent?

Usually not. Consent for electronic marketing is typically given to a specific organisation, so a buyer normally needs its own consent before marketing to consumers.

Can a liquidator sell customer data?

A liquidator can realise company assets, including data, but must still comply with data-protection law. Sales are commonly structured as part of a sale of the business, with restrictions on use.

What if I only want to sell anonymised data?

Properly anonymised data is outside UK GDPR, but anonymisation has to be robust. Pseudonymised data, where people could still be re-identified, remains personal data.

What should I do first?

Keep your systems running, list what you hold, and get advice before agreeing anything with a buyer.