The Insolvency–Privacy Conflict: Regulating The Transfer Of Personal Data During Corporate Insolvency In India

Abstract

When a company enters insolvency, its customer databases, employee records and user profiles often become some of its most valuable assets. Indian insolvency law treats these assets like any other property to be preserved, shared with bidders and, if needed, sold. Privacy law takes a different view. It treats personal data as something that belongs to the individual and may be used only for a lawful purpose. This article examines how the Insolvency and Bankruptcy Code, 2016 and the Digital Personal Data Protection Act, 2023 collide when personal data must be transferred during a corporate insolvency. It argues that the Code is silent on data protection, that the 2023 Act does not expressly provide for insolvency, and that this gap exposes data principals to avoidable harm. Drawing on Indian constitutional jurisprudence and comparative experience from the United States and the European Union, the article proposes practical reforms, including a data protection duty for insolvency professionals, staged disclosure of data, and a bar on sales that ignore the purpose for which the data was collected.