Data in German insolvency proceedings: what insolvency administrators need to know

A company's internal data can have considerable value for the estate. In the bankruptcy of the US airline Spirit Airlines, Google offered US$10 million for around 100 million emails and 500 million Microsoft Teams messages, and a competitor subsequently put forward US$12.5 million.^[1] The buyers are AI companies that train their models on real workflows. For insolvency administrators in Germany this raises a practical question: how can this value be realised without breaching data protection law?

Are company data from insolvency proceedings part of the estate?

Yes, in principle. Company data are part of the debtor's assets and therefore realisable estate. They are an additional source of proceeds that is often overlooked in realisations.

The insolvency estate comprises all assets belonging to the debtor at the time proceedings are opened and acquired during the proceedings (§ 35(1) InsO).^[2] § 36(2) no. 1 InsO clarifies that the debtor's business books belong to the estate; statutory obligations to retain records remain unaffected.^[3] The same applies to other company data: email archives, ERP and CRM data, tickets and documents arose in the course of business, belong to the company's assets and can be realised like machinery, inventory or receivables. Unlike these, however, they rarely appear in realisations, although AI companies now usually pay six-figure sums for them: for 50 to 250 employees buyers quote US$100,000 to US$1 million, and for a company with 100 employees and ten years of operations US$383,000 to US$897,000.^[15][16] More in the article What is company data worth? Cancelling servers and licences before the data have been secured gives this value away.

A judgment of the Higher Regional Court of Düsseldorf shows an important limit: an insolvent agency had sent newsletters for a client and stored the client's customer email addresses for this purpose. The court granted the client a claim for surrender, which entitles it to segregation in the insolvency (§ 47 InsO in conjunction with § 667 BGB).^[4] Data that the debtor only processed on behalf of someone else are therefore not freely available to the estate. Something similar applies to licensed third-party content such as software or external databases: whether they may be passed on depends on the licence agreement.

Who is responsible for the data under data protection law?

From the opening of proceedings, as a rule the insolvency administrator, and solely.

On the opening of proceedings, the right to manage and dispose of the debtor's assets passes to the insolvency administrator (§ 80(1) InsO).^[5] Because the administrator thereby decides on the purposes and means of processing, they are the controller within the meaning of Art. 4(7) GDPR. Joint controllership with the debtor under Art. 26 GDPR is ruled out according to the convincing view, because the debtor loses its power of decision.^[6] For the administrator this means bearing the obligations of the GDPR, for example on legal basis, purpose limitation and data security, and being liable for infringements (Art. 82 and 83 GDPR).

Debtor-in-possession proceedings are different. There, the debtor manages the estate itself under the supervision of a custodian (§ 270(1) InsO).^[7] The company then remains the controller.

May the administrator sell personal data?

Only within narrow limits. If personal data are transferred to a third party as the actual object of a sale, the data protection authorities generally require the consent of the data subjects.

The German Data Protection Conference (DSK) updated its principles on the transfer of customer data in asset deals on 11 September 2024. Where the customer data are the only asset sold, consent is generally required, particularly if buyer and seller operate in different industries. Bank and sensitive data may only be transferred with express consent unless they are necessary to perform a contract.^[8] An older case shows that the authorities take this seriously: in 2015, the Bavarian Data Protection Authority fined the seller and buyer of an online shop five-figure sums because customer email addresses had been transferred without consent.^[9]

For AI training there is a second problem: the data were collected to perform contracts and for internal communication, not to train AI models. Such a change of purpose is only permitted if it is compatible with the original purpose or a new legal basis exists (Art. 5(1)(b), Art. 6(4) GDPR). Asking thousands of employees, customers and suppliers for consent is practically impossible in an insolvency. The Börsen-Zeitung quotes the data protection lawyer Felix Glocker (CMS) on this: personal data from emails and Teams chats cannot simply be sold to the highest bidder like an ordinary asset.^[10]

How can company data still be realised?

Through effective anonymisation before the handover and a licence that governs the use.

The GDPR does not apply to anonymous information, i.e. data where the data subject is not or no longer identifiable (Recital 26 GDPR).^[11] Glocker therefore considers effective anonymisation before the resale to be the more realistic route. In the same article, Michael Rozijn (Schultze & Braun) points out that simply removing names may not be enough if the content still allows conclusions about individuals.^[10]

Pseudonymisation is different: names are replaced with identifiers, but the mapping is kept in a separate table (Art. 4(5) GDPR). For whoever holds this table, the data remain personal data. On 4 September 2025 the CJEU ruled that pseudonymised data are not automatically personal data for a recipient without additional knowledge; the controller's obligations, however, are assessed from its own perspective at the time of collection (C-413/23 P, EDPS v SRB).^[12] In practice this means: the mapping stays with the service provider and is deleted after the handover, and the buyer contractually undertakes not to attempt re-identification.

The anonymisation itself is also processing of personal data and needs a legal basis. The legitimate interest in realising the estate can serve as one (Art. 6(1)(f) GDPR). If a service provider carries out the anonymisation, it does so as a processor under a contract pursuant to Art. 28 GDPR. The balancing of interests and the contract should be documented and agreed with the data protection advisers of the proceedings. How we proceed technically is described on the page Anonymisation.

Which data are particularly sensitive?

Special categories under Art. 9 GDPR, personnel files, professional secrets and bank data. They are usually excluded before the realisation.

The Spirit Airlines case shows how sensitive employee data are: the flight attendants' union AFA-CWA objected to the sale and demanded restrictions on employee data; the court then postponed the hearing.^[13]

Which retention obligations remain?

The commercial and tax retention periods continue to apply. What is licensed is an anonymised copy; the originals remain available until the periods expire.

Since the Fourth Bureaucracy Relief Act, the following periods apply under § 257 HGB. They begin at the end of the calendar year in which the record was created (§ 257(5) HGB). Corresponding periods apply for tax purposes under § 147 AO.^[14]

How does a realisation work in practice?

In six steps, from an inventory without access to data to the deletion of the mapping.

1. Inventory: systems, period and volume are recorded without any data leaving the premises.
2. Rights review: membership of the estate, third-party data, licence agreements and sensitive data types.
3. Anonymous data sheet and buyer search: buyers see a description without names.
4. Data processing agreement and anonymisation as local data processing at the seller, i.e. in the infrastructure of the proceedings.
5. Sample under a non-disclosure agreement, then a licence agreement prohibiting re-identification.
6. Handover of the anonymised data and deletion of the mapping table.

What a dataset can bring is shown in the article What is company data worth? The buyer side is covered in Selling company data for AI training.