Do privacy obligations survive when a company closes?

What happens to privacy duties when a company dissolves?#

Privacy duties generally follow the personal information, not the legal entity, so they do not end when a company files a certificate of dissolution. Whoever holds the records during the wind-down, whether directors, a wind-down officer, an assignee or a bankruptcy trustee, inherits the practical job of honoring the promises made when the data was collected.

Dissolution starts a winding-up period in which the company collects assets, pays creditors and settles claims. Customer lists, support histories and employee files are part of what remains, and they carry the restrictions of the notices, contracts and laws that applied to them. Ignoring those restrictions may create claims against the people who distribute the company's assets.

The practical question is therefore not whether obligations survive but which ones attach to each record set, and who has authority to act on them now.

Which promises still bind the records?#

The promises that still bind closed-company records come from several documents, and each record set can sit under a different mix of them. A support archive may be governed by the website privacy notice and customer contracts, while HR files are governed by employee notices and employment law.

Collect these documents before deciding anything. Wind-down teams often find the controlling promise in an unexpected place, such as a master services agreement that requires deletion when the relationship ends or an old signup page that said customer details would never be shared.

• 1Privacy notices in effect when each record set was collected, including older versions of the website policy.
• 2Customer contracts, data processing addenda and order forms with deletion, return or confidentiality clauses.
• 3Employee and contractor notices, handbooks and offer letters that describe how personnel data is used.
• 4Vendor and platform terms that limit export or reuse of data stored in their systems.
• 5State privacy, breach notification and sector rules that may apply to the people in the records.
• 6Litigation holds and tax or payroll retention duties that require keeping certain records for a period.

Delete, transfer or de-identify: choosing a path for each record set#

Each record set in a closing company usually ends up on one of three paths: deletion, transfer to a successor under the original promises, or de-identification before any further use. Some records first sit in a fourth state, retained only to meet a legal or tax duty, and follow one of the three paths when that duty ends.

The path is chosen record set by record set, not for the company as a whole. A wind-down officer can delete a marketing contact list, transfer a support platform to the buyer of a product line, and de-identify engineering tickets for a data license, all within the same process.

What bankruptcy cases and regulators have said#

Bankruptcy law gives the clearest public signal that privacy promises outlive the business. Under Section 363(b)(1) of the Bankruptcy Code, if a debtor's privacy policy in effect when the case begins prohibits transferring personally identifiable information to unaffiliated parties, the trustee may not sell or lease it unless the sale fits the policy or the court approves it after a consumer privacy ombudsman is appointed and a hearing is held.

Regulators have pressed the same point. In 2000 the FTC sued Toysmart.com to block the sale of a customer list collected under a never-share promise, and the list was ultimately destroyed. In 2015 the FTC recommended that RadioShack customer data go only to a buyer in substantially the same line of business that agreed to be bound by the original policy. In March 2025 the FTC chairman wrote that any purchaser of 23andMe's assets should agree to be bound by its privacy policies.

Most mid-sized wind-downs never reach a bankruptcy court, but the pattern is a useful guide for dissolutions and assignments for the benefit of creditors as well: buyers inherit promises, and the original notice is the starting point for any transfer.

Illustrative: a closed scheduling software company#

Illustrative: a fictional vertical software company that sold scheduling and dispatch software to HVAC contractors decides to dissolve. Its wind-down officer finds four record sets: Zendesk support tickets, a HubSpot CRM of contractor contacts, Jira issues linked to those tickets, and a Slack workspace.

Its privacy notice said the company would not sell personal information, and many tickets quote homeowner names and addresses pasted in by contractors. The officer deletes the HubSpot marketing contacts once the tax retention review clears them, excludes Slack direct messages, and keeps the ticket-to-issue chains as a licensing candidate only after homeowner and contractor details are removed.

Counsel reviews the notice and concludes, for this company, that de-identified support and engineering workflows raise a different question from selling contact lists. The licensable package is narrower than the full archive, but every decision is written down, so the people distributing the company's assets can show how each record set was handled.

Preserve first: a checklist before subscriptions lapse#

Preservation comes first because many software vendors delete customer data on a fixed schedule once a subscription ends. Under the Salesforce Main Services Agreement, for example, customer data is made available for export if the customer asks within 30 days after termination, after which Salesforce has no obligation to keep it and will delete it unless legally prohibited.

Preserving data is not the same as deciding to use it. Export to storage the company or estate controls, restrict access, and make the delete, transfer or de-identify decision afterward with counsel.

• 1List every system that holds customer, employee or partner records and note its renewal or termination date.
• 2Check each vendor's export options and post-termination deletion terms in the contract and documentation.
• 3Export to encrypted storage owned by the company or the estate, never to a former employee's personal drive.
• 4Save every version of the privacy notice, terms of service and employee notices you can find.
• 5Record who holds authority over the records after dissolution or the appointment of a trustee.
• 6Apply litigation holds before running any deletion jobs.

How SourceX approaches records from a closed company#

SourceX handles a closed company's records through the same SourceX five-step transaction it uses for operating companies: Supply, Rights, Preparation, Approval and Delivery. The Rights step starts with the notices and contracts described above, and nothing is shared during the initial assessment, which collects only metadata about systems, date ranges and record families.

If a record set proceeds, the SourceX Evidence Packet records its provenance, licensing rights, permitted use, privacy record and release authorization, including which notice applied and who signed for the estate or wind-down entity. The person with authority over the records approves every step, and the data is licensed, not sold outright.