What happens to company data when a business shuts down?

The five outcomes for company data#

Company data at shutdown follows one of five outcomes, and each one has a decision-maker. The table shows who usually decides and what constrains the choice.

Most companies end up with a mix. Payroll records are kept, customer data is returned or deleted under contract, the codebase is sold, and some operational history may be licensed.

Who owns company data after the company closes?#

The company generally still owns its data after it stops operating, and that ownership continues until the records are transferred, licensed or deleted, or the company's affairs are fully wound up. Closing the doors does not move ownership to the founder, the employees or the software vendor.

SaaS vendors hold copies, but their terms usually treat customer content as the customer's while the account is active and for a limited window afterward. In a bankruptcy the records become part of the estate, controlled by the debtor or trustee; in an assignment for the benefit of creditors, the assignee controls them. Founders sometimes assume they personally keep the data after dissolution, which is generally not the case.

What has to be kept#

Records that tax, employment and corporate laws require must be kept for set periods even after the business closes. The periods vary by record type and jurisdiction, so the company's accountant and counsel should set the retention schedule rather than a rule of thumb.

These records rarely have licensing value, and most should be excluded from any data package. Their job is answering future questions from tax authorities, former employees and claimants.

• 1Tax returns, supporting ledgers and payroll tax filings.
• 2Payroll, benefits and personnel files for former employees.
• 3Corporate records: formation documents, board and stockholder minutes, equity ledgers.
• 4Contracts, leases and records needed to answer later claims.
• 5Any records under a litigation hold or government inquiry.

What has to be deleted or returned#

Customer data covered by contracts that require return or deletion at termination has to be returned or deleted, whether or not the company is closing. Master service agreements, data processing addenda and enterprise security terms often include these clauses, and they usually survive the end of the relationship.

Privacy notices create similar limits. If the company told users their information would not be shared, or would be deleted when no longer needed, that promise follows the data into the wind-down. Information received under NDAs from partners, prospects or acquirers belongs in the same review.

What can be licensed#

Operational records that show how the company did its work are the ones most often licensable, once personal and confidential details are removed. Examples include resolved support tickets, engineering issues linked to fixes, CRM activity histories, job and dispatch records, order exceptions and internal process documents.

Licensing differs from selling: the company grants a developer the right to use a prepared copy for defined purposes and keeps ownership of the records. That matters when the company is also selling its business or assets, because a non-exclusive license can sit alongside a sale if both buyers know about it.

Two conditions decide whether a licensable record actually gets licensed. The company must control the content rather than hold it for a customer, and the records must survive the shutdown with their links intact, which means exporting them before the systems that join them are cancelled.

How data gets abandoned#

Data gets abandoned through ordinary cost cutting rather than any decision. Subscriptions are cancelled to save money, admins leave, and records sit in vendor systems until a retention window closes and the vendor deletes them.

The fix is a register that gives every system an owner and a decided outcome before its subscription ends. A system with no decision stays open, even if that costs another billing cycle.

• 1The card on file expires and the help desk account lapses into deletion.
• 2The only CRM admin is laid off and nobody holds the recovery codes.
• 3Employee accounts in Google Workspace or Microsoft 365 are deleted without transferring their files.
• 4Records live in personal Dropbox folders or laptops that leave with departing staff.
• 5The domain registration lapses, taking email access and password resets with it.

Illustrative: a regional distributor decides record by record#

Illustrative: a fictional regional industrial distributor is closing after selling its customer accounts to a competitor. Its NetSuite instance holds orders, returns and credit memos; its EDI logs record trading partner transactions; and a shared mailbox holds years of order exception threads with suppliers and carriers.

The board decides record by record. Customer accounts and open orders transfer to the competitor under the asset purchase agreement. Financial records stay with a custodian under the accountant's retention schedule. EDI partner data is deleted as the trading partner agreements require. The order exception history, de-identified and stripped of supplier pricing, is assessed for licensing, with the competitor's consent written into the purchase agreement because the exceptions concern accounts it bought.

No system is cancelled until its records have a decided outcome, which takes abandonment off the list.

How SourceX helps with the licensing outcome#

SourceX works on the licensed-or-sold outcome, and in practice it licenses rather than sells. The first step is a metadata-only fit check of systems, years of history and record families, so a closing company learns whether licensing is realistic before it changes any shutdown plans.

Where a package proceeds, the SourceX Enterprise Data Value Framework guides which record families are worth preparing, and the SourceX Evidence Packet documents provenance, licensing rights, permitted use, the privacy record and release authorization.