Restart after bankruptcy: which archive do you take?
In a restart you buy assets out of a bankruptcy, often from the trustee. Stock, machines, a brand name and sometimes the customer relationships. What is easily overlooked is the data side: customer databases, personnel data, old files and full data carriers travel along. Take them over without a plan and you inherit the risks of the bankrupt company too. This guide shows which archive you take and which you do not, what is allowed under the GDPR and how to destroy the rest confidentially.
The quick answer: you only take over what is agreed in the asset transaction and what you may process under the GDPR. The tax administration of the bankrupt legal entity stays with the trustee. Taking over personal data requires a legal basis and usually informing the data subjects. Everything you do not need you clear out confidentially straight away.
A restart is not an automatic takeover of all data
The biggest misconception is that with the assets you automatically get all data and files too. That is not how it works. A restart is a new business that buys specific assets. What you take over is in the purchase agreement with the trustee, and only that. The administration of the bankrupt legal entity itself stays in the estate, managed by the trustee. How that side works is in bankruptcy: archive to the trustee or destroy.
So treat the data side as carefully as the rest of the transaction. Agree explicitly which files, records and data carriers come along, and in what state. Without that agreement you get, at handover, a pile of equipment and paper that no one knows the contents of, or whether you may use it.
The GDPR angle: may you take over the customer database?
Taking over customer data and personnel data is a processing of personal data, even when it runs through a bankruptcy. A bankruptcy is no free pass to start using a complete customer database without rules. You need a legal basis, and you usually have to inform the data subjects about who the controller now is and for which purpose you use the data.
If you want to actively approach the bankrupt company's customers with offers, that is a purpose of its own that requires its own assessment. So include the customers you take over in your own record of processing and describe the basis, purpose and retention period. More on that in record of processing, archives and destruction. If you are unsure about the limits of what is allowed, consult a privacy lawyer.
What you take and what the trustee keeps
The overview below helps you separate the data side. Record the arrangements in the asset transaction.
| Item | Take or not | Note |
|---|---|---|
| Running customer contracts | Take if transferred | with basis and informing |
| Customer database for marketing | Only with own assessment | new purpose |
| Personnel files of retained staff | Take | per item |
| Tax administration of bankrupt company | Stays with trustee | estate |
| Old files without a purpose | Do not take | avoid data burden |
| Data carriers from the estate | Transfer and secure | rest wipe or destroy |
Use this as a guideline. The exact split depends on the purchase agreement and on what the trustee hands over.
Do not take over the bankrupt company's data burden
A bankrupt company often has an archive that has not been cleared out for years. Full folders, old personnel files, expired customer data and stacks of paper no one looks at any more. If you take those over unquestioningly, your restart begins with a mountain of personal data without a purpose. That is exactly the burden you do not want to inherit, because you do become responsible for it.
So limit the takeover to what you genuinely need and for which you have a basis. Anything outside that you preferably do not take. If it does come along, for example because it is physically on the same location or the same server, clear it out straight away. That way you start clean instead of with someone else's legacy.
Acquired data carriers and systems
In a restart, servers, laptops, phones and external drives often come along. They usually hold a mix of data you need and data you may not or do not want to use. First transfer carefully what falls within the transaction to your own environment. Secure that environment properly right away, so the acquired data is in order from day one.
For the data carriers with data you do not take over, the same principle applies as with an ordinary disposal. Deleting a file is not enough, because the data stays on the disk. Have those carriers wiped or destroyed, so no old personal data is left unmanaged on equipment that is now yours. How that works is in how is a hard drive shredded.
How to handle it in 6 steps
- Record which files, records and data carriers the restart takes over.
- Check the basis for taking over customer and personnel data.
- Inform the data subjects about the new controller and the purpose.
- Transfer what you need to a properly secured environment of your own.
- Clear out the rest you do not take over, confidentially and not into the paper bin.
- Wipe or destroy the data carriers with data that does not come along.
Destroy confidentially with a certificate
The files and data carriers you do not take over are destroyed confidentially. For material with customer and staff data a fine shred is the starting point. It travels sealed and stays that way until destruction, so the chain is closed and nothing can leak on the way.
Afterwards you receive a certificate of destruction with the date, quantity and level. That certificate demonstrates that you had the non-acquired data removed carefully, and that you therefore do not keep carrying the bankrupt company's data burden. When clearing out estate material, do align with the trustee about what is allowed. We collect within 20 km of Amsterdam with no call-out charge, work nationwide through pooled collection rounds and charge a fixed price per box or roll container. Drop-off on site is not possible; it works by appointment through collection.
Left with a mountain of old data in the restart?
Tell us what you want to clear out and you get a fixed price. We collect it sealed, destroy it at the right DIN level and you receive a certificate. No call-out charge within 20 km of Amsterdam.
Request a quoteCommon mistakes
- Thinking a bankruptcy is a free pass. The GDPR fully applies when taking over data.
- Taking over the whole customer database without a basis. Active approaching requires its own assessment.
- Not informing the data subjects. Customers and staff should know who now manages their data.
- Dragging the data burden along. Old files without a purpose become your responsibility.
- Reusing data carriers unwiped. Then you run someone else's data in your systems.
Frequently asked questions
May I simply take over the customer database in a restart?
Not just like that. Taking over a customer database is a processing of personal data. You need a legal basis and usually have to inform the data subjects about the new controller and the purpose.
Who remains responsible for the bankrupt company's administration?
The trustee manages the estate and the administration of the bankrupt legal entity. That tax administration does not move into the restart. You only take over what is agreed in the asset transaction.
What do I do with acquired data I do not need?
Data without a purpose or basis you do not keep. Clear it out as soon as it arrives, confidentially and with a certificate, so you do not take over the data burden of the bankrupt company.
Should I have acquired data carriers wiped or destroyed?
Transfer what you need and secure the rest. Data carriers with data you do not take over you have wiped or destroyed, so no old personal data is left unmanaged.
Conclusion
A restart after bankruptcy is a chance to start clean, but only if you treat the data side as carefully as the rest of the transaction. Take over only what is agreed and what you may process under the GDPR, inform the data subjects and leave the bankrupt company's administration with the trustee. What you do not need you clear out confidentially straight away, in consultation with the trustee, and close with a certificate. That way you inherit the opportunities of the restart without the data burden of the bankruptcy.
Read also: bankruptcy: archive to the trustee or destroy, business takeover and archive due diligence, closing a business: what to keep and destroy and merger: consolidating two archives.
Have old data collected in the restart? Request a quote via desnipperaar.nl. Within a few minutes you have a fixed price, including a certificate as proof.