Data in the Crucible: Reimagining User Databases as Assets or Liabilities in Indian Insolvency

Imagine a mid-sized Indian fintech company, one that spent years building a loyal base of two million users, logging their spending habits, credit profiles, and financial aspirations. Then, one quarter, the funding dries up. Creditors move in. A Resolution Professional (RP) steps in and begins cataloguing assets. There is office furniture, some software licences, and then that database: two million meticulously curated user profiles, arguably the most commercially valuable thing the company ever built. The question that follows is deceptively simple: can it be sold to cover the company’s debts, like other assets?

Although the question appears straightforward, it exposes a collision between two of India’s most consequential modern statutes: the Insolvency and Bankruptcy Code, 2016 (“IBC”), and the Digital Personal Data Protection Act, 2023 (DPDPA). For creditors and resolution professionals, the answer ought to be yes. For the millions of users whose information sits in that database, the answer may well be the opposite. This article explores that tension and why resolving it demands a far more nuanced framework than either statute currently provides.

The Mandate of Maximisation: How Insolvency Law Views Data

Parliament introduced the IBC to change how India deals with troubled companies. It aims to end long legal battles and settle matters quickly to maximise returns for creditors. In this view, a user database is just another company asset, to be kept safe, valued, and sold to help pay off debts. This characterisation is not arbitrary. The liquidation estate consists of all assets available for distribution to creditors during winding up.

Section 36(3)(d) of the IBC expressly includes intangible assets, intellectual property, and contractual rights. A user database typically falls within this definition because users agree to terms of service that govern its use. Sections 18 and 25 of the Code further reinforce this position. The RPs must take immediate custody and control of all assets of the corporate debtor.

Additionally, Section 29 mandates that most digital businesses prepare an information memorandum for prospective bidders that includes all relevant information; user data is central to that picture.

In effect, the IBC encourages an RP to view a database not as a collection of personal identities but as a balance-sheet asset with measurable commercial value. The question, however, is whether the law still permits that view in 2026.

A New Paradigm of Privacy: The DPDP Act’s Rights-based Framework

The Digital Personal Data Protection Act, 2023 (“DPDPA”), emerges as a formidable counterweight. It is rooted in the Supreme Court’s landmark verdict in Justice (Retd.) K.S. Puttaswamy v. Union of India, which recognised privacy as a fundamental right. The DPDPA reframes the entire narrative around personal data. An RP who takes over a corporate debtor’s data operations effectively becomes a ‘Data Fiduciary’ and assumes the Act’s obligations.

The central hurdle is Section 4 of the DPDPA, which permits the processing of personal data only for a lawful purpose and only with the individual’s explicit consent. Selling a user’s data to an unknown third-party acquirer for undisclosed commercial purposes differs fundamentally from the purpose for which the company originally collected that data.

Section 6 raises the bar further, defining valid consent as “free, specific, informed, unconditional and unambiguous.” It would be difficult to argue that an initial sign-up consent stretches to cover the sale of personal data in an insolvency auction.

Furthermore, Section 8 of the DPDPA adds another dimension. It obligates a Data Fiduciary to erase personal data once the specified purpose is no longer served. For a company winding down, one could reasonably argue that the original purpose has lapsed, triggering an obligation to delete the data rather than monetise it.

It is also worth considering the extent of authority that the DPDPA vests in regulatory bodies. The Data Protection Board carries wide-ranging powers to investigate breaches and impose penalties. As a result, any person who acquires or handles the data during an insolvency proceeding must comply not only with contractual obligations but also with active regulatory oversight.

That is a compliance burden with real financial consequences, and one that prospective buyers of distressed digital assets would be unwise to ignore.

When a Corporate Asset Becomes a Personal Liability

This statutory conflict gives rise to a deep paradox in how resolution professionals should assess the value of a user database during insolvency. The DPDPA does not require a company to erase a user database from its asset register. What it does, however, is fundamentally alter the nature of that asset, transforming it from a freely transferable resource into one that carries significant legal constraints on its use.

The primary source of this constraint is the suite of individual rights the DPDPA confers on users. Chief among these is the right to withdraw consent and demand erasure of personal data. In practical terms, these rights operate as a statutory encumbrance on the data: at any point after acquisition, an indeterminate portion of the database could legally cease to exist.

Consider what this means for valuation. An appraiser attempting to assign a reliable monetary figure to the asset faces a moving target; the data’s composition, and therefore its commercial utility, is subject to ongoing attrition driven by user decisions. Valuing an asset becomes difficult when the individuals whose information constitutes it can legally diminish or extinguish its value.

This uncertainty translates into contingent liability for prospective buyers. Any acquirer must price in not only the risk of the database shrinking post-acquisition, but also the risk of inheriting regulatory liability for non-compliance with the DPDPA.

Penalties under the DPDPA can reach ₹250 crores per violation, a figure that, on its own, could deter serious bidders and depress the recoverable value for creditors. In this way, a dataset that once appeared to be a primary commercial asset may, under the DPDPA’s regime, more closely resemble a contingent liability sitting on the balance sheet.

Global Precedents in Data and Distress

The ambiguity India now confronts has international precedent. Other jurisdictions’ experiences offer instructive guidance on how courts and regulators have navigated similar instances.

The landmark case of Toysmart.com in the United States is perhaps the most instructive illustration of exactly the kind of legal impasse India’s resolution professionals may soon encounter. Toysmart’s privacy policy explicitly promised not to share personal information with third parties. Yet, upon filing for bankruptcy, the company sought to sell its consumer database as a core asset.

The U.S. Federal Trade Commission (FTC) intervened, characterising the proposed sale as a deceptive trade practice. The eventual settlement held that the data could only go to a qualified buyer, i.e., one operating in the same line of business and bound by equivalent privacy commitments. When no such buyer materialised, the data authorities destroyed it.

The case established a principle that is directly relevant to India’s situation: privacy commitments made to users are not ordinary debts that dissolve in bankruptcy. They are tied to the data itself and constrain how parties may deal with that data in every circumstance. The Toysmart outcome illustrates precisely the ambiguity this article grapples with; even a commercially valuable dataset can become legally unsellable when privacy obligations the market cannot accommodate burden it.

The collapse of Cambridge Analytica offers a cautionary tale from the opposite direction, and one that sharpens the same ambiguity from a different angle. Cambridge Analytica’s business model rested on the harvesting and exploitation of personal data on a massive scale, largely without genuine informed consent.

Rather than constituting a recoverable asset in insolvency, that data became the epicentre of global scandal, regulatory investigation, and ongoing legal liability. Far from generating value for creditors, it accelerated the firm’s demise and continues to generate legal consequences.

Together, these cases underscore a single uncomfortable truth: the value of a user database does not depend solely on its commercial potential, but equally on the legal and reputational weight of the privacy obligations attached to it. India’s insolvency framework has yet to develop a coherent answer to that reality.

Forging a Path to Harmony: From Conflict to Coherence

The conflict, while profound, is not insurmountable. Since the legal ownership of such collected user data remains ambiguous, treating data as a quantifiable commercial asset remains difficult. The most viable and legally sound path forward lies in a concept that sits at the intersection of both statutes, ‘data anonymisation’.

The DPDPA applies only to personal data, that is, data which can be linked back to an identifiable individual. Data processed so thoroughly that no individual remains identifiable falls outside the Act’s scope entirely, and courts and regulators treat it as intellectual property or proprietary business information.

Instead of attempting a legally precarious direct sale of a raw user database, an RP could engage technical experts to irreversibly anonymise the data. The resulting product, a rich repository of aggregated market trends, behavioural patterns, and sector-level insights, could then serve as a genuine business asset. This approach allows for the realisation of economic value while honouring the privacy rights of the individuals whose information underlies it.

Regulatory clarity would go a long way in making this workable. The Insolvency and Bankruptcy Board of India (IBBI) could, in conjunction with the Data Protection Board, issue joint guidance for RPs (Resolution Professionals) on the treatment of digital assets and the technical standards required for effective anonymisation. Without such guidance, RPs must navigate competing statutory obligations largely on their own, with significant personal liability attached to each decision they make.

Additionally, the National Company Law Tribunal (NCLT), which adjudicates insolvency matters in India, may mandate that any transaction involving personal data during a resolution process undergo explicit review for compliance with the DPDPA. The IBBI, for its part, can consider amending its regulations to include specific parameters for valuing digital assets in a privacy-constrained environment. In the absence of such regulatory parameters, valuation professionals have no clear methodology for pricing a database whose usable portion no one can confidently predict.

Conclusion

India stands at a genuinely novel juncture. The IBC and the DPDPA are each progressive pieces of legislation in their own right. The challenge now lies in ensuring that they operate in concert rather than in conflict, and balancing the economic imperatives of insolvency resolution with the privacy expectations of a digitally active population.

Getting this balance right will matter not only to creditors and resolution professionals, but also to the millions of ordinary users whose data sits quietly at the centre of these corporate dramas, waiting to learn what rights they have left. Ultimately, a coherent framework will protect privacy rights without undermining the objectives of insolvency resolution.