Insolvency and Administration Security: Data and Access

When a company fails, its data and its access paths outlive the people who looked after them, and nobody is clearly in charge of either. In the weeks before and after an insolvency appointment, staff leave, suppliers suspend services for unpaid invoices, administrator accounts and recovery phones belong to people who are gone, and the customer database becomes an asset someone wants to sell. This guide covers the security of data and access from financial distress through administration to sale or dissolution: what to secure first, how to hand control to an office holder, how data can and cannot be sold, breach handling when the company is in administration, and how records and equipment are kept or destroyed. It is written for security and IT leads at a distressed company, for insolvency practitioners and their advisers, and for buyers of distressed assets. It is not about restructuring strategy or creditor rights. For individual leavers see the Departing Employee Data Protection Playbook.

Source note: insolvency, data protection and bankruptcy rules below are summarised from GOV.UK, legislation.gov.uk, the FCA, the ICO, the insolvency professional bodies, Cornell LII and the FTC, as checked in November 2026. Priority orders, decision tables and timelines are NHI Mgmt Group recommendations, not legal requirements. This is not legal advice. Confirm against the official text before relying on it.

Key takeaways

Control of the company changes hands, but data protection duties do not disappear. UK guidance from the insolvency professional bodies says office holders cannot set aside books, records or equipment just because of data protection burdens.
The first week is about locating and locking access. Administrator accounts, cloud root users, domain registrars, signing keys and recovery factors tied to departed staff are the assets that matter most.
Unpaid suppliers are a data integrity risk. Cloud and SaaS services suspended or closed for non-payment can lose logs, backups and evidence the office holder needs.
Customer data is sellable only within the promises made. US bankruptcy law ties sale of personal data to the debtor's privacy policy, and UK regulators have warned against unlawful sale of client data in administrations.
Dissolution is a security event too. Domains, email addresses and API keys that lapse without being shut down cleanly become takeover routes into customers and partners.

Why a failing company is a security problem

Distress concentrates the conditions that create incidents. Security staff are often among the first to leave, monitoring and managed security contracts lapse, and the people who remain are focused on cash. When an administrator is appointed in the UK, GOV.UK guidance says directors must hand over control of the company and everything it owns, and the administrator can cancel contracts and make staff redundant. The administrator inherits systems they did not build, credentials nobody wrote down, and data they are legally responsible for handling properly.

Stage	Typical events	Security risk
Distress	Hiring freeze, layoffs, suppliers on stop, unpaid licences	Departing administrators, lapsed monitoring, security tools switched off to save cost, insider data theft
Appointment	Office holder takes control; most staff made redundant	Unknown credentials, recovery factors on former staff devices, no one watching alerts, devices not returned
Trading in administration	Business kept running for a sale	Thin team running live systems; contractors given broad access; unclear controller responsibility
Sale of business or assets	Data rooms, buyer due diligence, transfer of systems	Over-sharing personal data in due diligence; selling data beyond its original purpose
Wind-down and dissolution	Systems switched off, equipment sold, domains lapse	Unwiped equipment, expired domains re-registered by others, leftover integrations and keys at customers

Many of the distress-stage controls are the same as for any mass exit; see Security During Layoffs.

Before appointment: what the company's own security lead should do

If you are the security or IT lead at a company heading towards insolvency, the most useful thing you can leave behind is a clean, documented handover. In the UK, section 235 of the Insolvency Act 1986 places a duty on current and former officers and on employees the office holder considers able to help to give information the office holder reasonably requires, and failure without reasonable excuse is an offence.

Write the access register. Every identity provider, cloud account, domain registrar, DNS host, code platform, payment and banking portal, and SaaS tenant: who holds admin, where the recovery factors live, and where break-glass credentials are kept. See the Break-Glass Account Guide.
Move recovery factors off personal devices. MFA on a former employee's phone, recovery email at a personal address and hardware keys in someone's desk drawer can lock the office holder out of the company's own systems.
List the secrets and non-human identities. Signing keys, certificates, API keys issued to customers and partners, OAuth app registrations in customer tenants, and service accounts, with owners and expiry dates. See the NHI Offboarding and Decommissioning Guide.
Record what data is held and where. Data types, locations including any held outside the UK or EU, retention rules and any data already due for deletion.
Flag suppliers at risk of suspension. Cloud, backup, logging and email providers owed money, with the date a suspension or closure would take effect.
Preserve logs. Export identity, cloud and email audit logs to storage the office holder will control, in case directors' conduct or a breach needs investigating later.

The first week after appointment

The professional bodies' GDPR guidance for insolvency practitioners (issued jointly by ICAEW, IPA, ICAS, ACCA and R3) recommends a data security risk analysis with the company's data protection contact before appointment, locating and securing laptops and mobile devices, checking encryption and remote lock, and documenting the decision to collect or not collect equipment. NHI Mgmt Group recommends turning that into the following priority order.

Priority	Action	Why it comes first
1	Take control of the identity provider, email domain, DNS and domain registrar	Whoever controls these controls password resets for everything else
2	Take control of cloud root or organisation admin accounts and payment methods	Prevents account closure, data deletion or misuse, and stops suspension for non-payment
3	Disable accounts of departed staff, revoke their sessions and tokens, and rotate shared and break-glass credentials	Former staff, and anyone who phishes them, otherwise keep a way in
4	Locate, lock or remotely wipe company devices; collect those that can be collected	Lost devices with personal data may be a reportable breach
5	Secure backups and logs; pay or negotiate with critical suppliers	Backups and audit logs are evidence and the only route to recovery
6	Restore alerting to someone who will read it	An unmonitored estate in administration is an easy target

Least privilege for the office holder's team: give named accounts with MFA to the people who need them, not a shared admin login, and keep the access register up to date as staff and contractors change.
Retain access to departed staff data: NIST SP 800-53 PS-4 requires retaining access to organisational information and systems formerly controlled by terminated individuals. Transfer mailbox and file ownership before deleting accounts.
Know the supplier deadlines: cloud providers apply grace or post-closure periods before deleting data. AWS documentation, for example, describes a 90 day post-closure period after which account content and resources are deleted, apart from CloudTrail trails, and the account cannot be reopened. Check each provider's own terms; the clock may already be running.

Selling data and systems

A customer database can be one of the few valuable assets left, and it is also the asset most likely to create liability for whoever handles the sale.

Regime	Rule	What it means in practice
UK (FCA, ICO and FSCS joint statement, February 2020)	Regulators warned that some insolvency practitioners and authorised firms had tried to sell clients' personal data to claims management companies unlawfully, and that standard contract terms are highly unlikely to be valid consent for that sharing	Check the lawful basis and the original purpose before any transfer of customer data; marketing follow-up may also breach PECR
UK professional bodies' GDPR FAQs	A database can still be sold, but the seller needs records of what people were told and consented to; a buyer wanting a new purpose needs fresh consent	Consent records are part of the asset; poor records reduce value and increase risk
US Bankruptcy Code, 11 U.S.C. 363(b)(1)	If the debtor's privacy policy promised not to share personal information with unaffiliated parties, a sale must be consistent with that policy, or the court must approve it after a consumer privacy ombudsman is appointed under section 332	The privacy policy in force at filing decides what can be sold; the ombudsman reports on privacy losses and alternatives to the court
US FTC (23andMe bankruptcy, March 2025)	The FTC Chairman wrote to the US Trustee about a possible sale of customer data, stating that consumers should be able to trust companies to keep their promises	Expect regulator scrutiny where sensitive data is sold in bankruptcy

Security controls for the sale

Data rooms: share schema, volumes and consent evidence, not live personal data. The professional bodies' guidance advises redacting personal data in due diligence where appropriate.
Transfer of systems: rotate every credential at the point of transfer so that former staff, the office holder's contractors and other bidders lose access. Treat it like an acquisition; see the Cyber Due Diligence in Mergers and Acquisitions Guide.
Data not sold: data excluded from the sale has to be retained or destroyed by the office holder, not left on the systems the buyer receives.

Breaches during administration

A breach does not wait for the insolvency to finish, and the conditions of administration make one more likely. The ICO says a personal data breach must be reported to it as soon as possible and, where feasible, within 72 hours where it is likely to result in a risk to people's rights and freedoms, and individuals must be told without undue delay where the risk is high (the ICO notes this guidance is under review following the Data (Use and Access) Act 2025). The professional bodies' FAQs say lost or stolen devices count, and recommend keeping a breach register and documenting decisions not to report.

Who reports: the professional bodies' guidance notes that whether an office holder is a controller or processor for the company's records is not settled. Agree with legal advisers who notifies, and record it.
Unrecovered devices: list every device not returned, whether it was encrypted and whether remote wipe succeeded. That list decides whether a report is needed.
Former staff access: sign-ins from disabled accounts or use of rotated keys after appointment are a strong signal. See the Leaver Retained Access Incident Playbook.
Notification mechanics: see the Breach Notification Laws by Country Guide for other jurisdictions.

Records, retention and disposal

Office holders need records for their own investigations and for employee and creditor claims, so deletion has to wait for the case and the retention period. The professional bodies' FAQs say data protection cannot be used to erase evidence and that erasure requests can be refused where statutory duties apply.

Keep what the case needs: books and records, payroll and HR files, contracts and audit logs. Payroll records can include special category data such as trade union membership, which needs an additional processing condition.
Destroy what is not needed: on a documented schedule, with legal hold where litigation is expected. See the eDiscovery and Legal Hold Guide and the Data Retention and Secure Deletion Guide.
Sanitise equipment before sale: laptops, servers, phones and storage sold as assets must be wiped first. NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (final, September 2025), sets out a sanitisation programme with techniques chosen by data sensitivity. Keep certificates of sanitisation per asset.
Paper and premises: records left at closed premises need secure destruction, and building access should be controlled until they are removed.

Where identity fits: shutting down cleanly

The last security job in a wind-down is closing the access paths that point outward, to customers and partners.

Revoke keys issued to and by others: API keys the company issued to customers, and keys customers issued to the company, should be revoked and the other party told. See the API Key Management Guide.
Remove integrations from customer tenants: OAuth applications and service principals the company registered in customers' environments keep their consent until someone removes them. Write to customers so they can revoke them.
Retire signing keys and certificates: revoke code signing and TLS certificates that will no longer be used, so they cannot sign anything after the company's systems have been sold or abandoned. See the Cryptographic Key Management Guide.
Decide what happens to domains: a lapsed domain can be re-registered by anyone, who then receives password reset and invoice emails sent to the old addresses. Sell the domain with the business, transfer it to the office holder, or keep it registered and parked for long enough that dependent accounts have moved. See the Domain and DNS Management Policy Template.

If your supplier is the one failing

Customers of a failing supplier face the mirror image. Request return or deletion of your data under the contract, revoke the supplier's access to your systems, rotate any credentials you shared with it, and remove its integrations. The Vendor Offboarding and Termination Guide covers the process, and the Cloud Concentration Risk and Exit Strategy Guide covers planning for it before it happens.

Decision guidance and measurement

The decisions below are NHI Mgmt Group recommendations.

Decision	Choose this when	Choose the alternative when
Keep systems running versus shut down	The business is trading for a sale and the buyer needs live systems	No sale is likely: export what the case needs, then shut down and sanitise
Retain former staff on short contracts versus outside contractors	Former staff hold irreplaceable knowledge and are cooperative	Trust is low or the departure was contentious: use contractors with named accounts and full logging
Sell the customer database versus destroy it	Consent records are good and the buyer's use matches the original purpose	Records are poor, the data is sensitive, or the privacy promise forbids transfer

Small companies with one IT person can cover the first-week list in a day with a checklist; larger estates need a short project with an owner per system. Either way, track these measures:

Access register coverage: percentage of systems with a confirmed admin under the office holder's control.
Former staff accounts still active: count after the first week, target zero.
Devices unaccounted for: number not returned or remotely wiped, each assessed for breach reporting.
Credentials rotated at transfer: percentage of shared, break-glass and service credentials rotated at sale or handover.
Assets sanitised with certificate: percentage of equipment sold or scrapped with a recorded sanitisation result.

Framework mapping

Framework	Reference	How it applies
NIST SP 800-53 Rev. 5	PS-4 Personnel Termination	Disable access, revoke credentials, retrieve property and retain access to information formerly controlled by leavers
NIST SP 800-53 Rev. 5	MP-6 Media Sanitization, SI-12 Information Management and Retention	Sanitising equipment before sale; keeping records for the case and retention period
NIST CSF 2.0	PR.AA-05, PR.DS-01	Access managed and reviewed through the handover; data at rest protected while custody changes
UK GDPR (as summarised by the ICO)	Personal data breach reporting	72 hour reporting where feasible for breaches likely to result in risk
US Bankruptcy Code	11 U.S.C. 363(b)(1) and 332	Sale of personal information limited by the privacy policy or court approval with an ombudsman

Common failure patterns

Locked out of your own estate. The only admin MFA is on a former employee's phone and the registrar account recovery goes to a personal mailbox.
Logs deleted by a supplier. A logging or cloud account is closed for non-payment, and the evidence needed for a director conduct report or breach investigation goes with it.
Former staff keep tokens. Accounts are disabled in the identity provider, but code platform and package registry tokens survive, as in the Ledger Connect Kit compromise, where a former employee's unrevoked npm access was abused.
Keys left in the wild. Signing keys held by departed staff are never rotated; the Coupang breach shows what a former engineer can do with one, even at a company that is trading normally.
Laptops sold with data on them. Equipment is sold in a hurry to raise cash without sanitisation or records.
Customer data sold beyond its purpose. A list is sold for marketing without consent records, creating liability for the office holder and the buyer.

Practitioner checklist

Build and hand over an access register covering identity, cloud, domains, DNS, code, payments and SaaS, with recovery factors.
Move MFA and recovery details off former staff devices and personal mailboxes.
Take control of identity, email domain, DNS and registrar first, then cloud admin and payment methods.
Disable departed staff accounts, revoke tokens and rotate shared, break-glass and signing credentials.
Find every supplier deadline for suspension or deletion and protect backups and audit logs.
Check the privacy policy and consent records before any sale of personal data, and keep personal data out of data rooms.
Keep a breach register, including unreturned devices, and agree who notifies the regulator.
Retain records for the case and retention period, then destroy on a documented schedule.
Sanitise all equipment before sale and keep a certificate per asset.
Revoke outward-facing keys, integrations and certificates, and decide the future of every domain.

Standards and references

Related NHI Mgmt Group resources: Security During Layoffs · Departing Employee Data Protection Playbook · Vendor Offboarding and Termination Guide · Data Retention and Secure Deletion Guide. This guide summarises insolvency, data protection and bankruptcy rules for security purposes and is not legal advice.

Insolvency and Administration Security: Protecting Data and Access When a Company Fails