What Happens to Corporate Data When a Business Closes?

By Danny Bradbury • 5 November 2026 • 7 min read

When a business closes, its data doesn’t simply disappear. U.S. flight operator Spirit Airlines demonstrated this when it ceased operations on 2 May this year and entered liquidation.

Its remaining assets, including de-identified enterprise data, were subsequently put up for auction. Google emerged as the successful bidder in August, beating two AI data training companies to scoop up the dataset for $10 million.

The airline’s customers wouldn’t have anticipated becoming part of a Google training set when they clicked the ‘submit’ button to buy a low-cost flight. Neither would have employees anticipated their workplace communications might one day become valuable AI training material. It raises the question: what happens to corporate data, and the obligations it carries, when the original collector no longer exists?

It’s a contentious issue, which is why 119 members of Congress objected to the sale on privacy grounds.

A Bankrupt Airline’s Inbox Has Become an AI Asset

The Spirit Airlines data haul is a treasure trove for AI training. It includes extensive operational information related to around 190m Spirit flights, ranging from productivity and collaboration data from corporate email and SharePoint repositories through to Teams chats and data from CRM and revenue management systems. Audit and fraud data joins aircraft operations and employee productivity data in the mix. The numbers are staggering; the data sets contain 100 million emails and 500 million Teams messages.

Those emails and chats are among the assets that buyers want most, along with HR files and logs, because they show how a real organisation ran. AI training thrives on real-world data like this.

Google said that it wasn’t looking for personally identifying information (PII) from Spirit, and that a third party would de-identify it. Some data such as passenger databases was also excluded from the corpus to get the privacy ombudsman’s support for the sale.

De-identification Protects Passengers, but Leaves Staff Exposed

However, these safeguards were built for consumers, and the ombudsman didn’t examine risks to employees or other third parties. The Congressional letter pointed that out, as did the Association of Flight Attendants in court.

Under the sale agreement, Google also gets to pick and pay the de-identification agent. And the process will also preserve links between records across the dataset, which the AFA worries will make it easier to re-identify employees.

The European Data Protection Board has already given its opinion on the use of personal data for training, stating that AI models trained on personal data aren’t automatically anonymous. Each case must be judged on its own merits, it says, citing the likelihood of extracting personal data via queries as a key factor.

The Obligations Outlive the Company, Even When the Purpose Changes

Under the US Bankruptcy Code, even personal data that a company promised not to share can be sold if a judge approves the sale after a hearing, once a consumer privacy ombudsman has been appointed to advise the court.

This issue has surfaced in several high-profile cases where regulators have intervened when administrators try to sell data after a company’s demise. Bankrupt toy retailer Toysmart advertised customer data in the Wall Street Journal in 2000, but the FTC stopped it because its privacy statement had told customers, “your information will never be shared with a third party”. The resulting settlement limited the sale to a ‘qualified buyer’ that would only use it to maintain customer service. When RadioShack went into liquidation in 2015, the FTC also imposed rules, such as limiting the sale to a company similar to RadioShack.

Sometimes, US law offers limited protection for consumers. Genetic testing company 23andMe moved to sell off its assets after it filed for Chapter 11 bankruptcy in March 2025. Chrome Holding Co, which was a corporate shell to administer the selloff, got $305 million for the sale of 15 million customers’ data to TTAM Research Institute. In that case, though, TTAM was a non-profit organisation founded by former 23andMe CEO Anne Wojcicki. That didn’t stop several states from (unsuccessfully) opposing the sale under the Genetic Information Privacy Act.

The UK’s Information Commissioner said that a 23andMe buyer must honour the UK GDPR limits on data reuse, including using the data only for what was stated under the original agreement.

However, much of the debate in these cases has focused on consumer data, rather than the extensive employee records and internal communications at the centre of the Spirit Airlines controversy.

What Good Information Governance Looks Like Before Data Changes Hands

The Spirit Airlines case highlights an important challenge for organisations: information collected for one purpose can acquire significant commercial value for an entirely different use, even after the organisation that originally collected it has ceased operating.

It also raises questions that go well beyond insolvency. Businesses regularly transfer information through mergers, acquisitions, restructuring and supplier arrangements. As AI creates new opportunities to use existing datasets, understanding what information an organisation holds, why it was collected and what restrictions apply to its use becomes increasingly important.

This is where established governance frameworks can provide valuable foundations.

ISO 27001 contains controls that help to establish those data governance foundations, so that should a post-bankruptcy sale ever become necessary, the data itself will be in good standing. Under Annex A control 5.33 (Protection of records), organisations can define a records policy with retention, storage, and disposal requirements that help protect records from unauthorized access or loss.

Annex A control 8.10 on information deletion provides the counterpoint to the retention control by describing how to delete or anonymize data that is no longer needed. That would limit the data reaching administrators in the event of a sale, with a paper trail to demonstrate sound policy.

ISO 27701 adds a privacy management perspective, helping organisations establish processes for documenting why personal data is collected, how it is processed, how long it should be retained and the conditions under which it may be shared or reused. This becomes particularly important when data changes ownership or its intended use changes.

ISO 42001 provides a framework for managing the risks and impacts associated with AI systems, including how data is acquired and used. Where an organisation intends to use an existing or newly acquired dataset for AI development, it can support the assessment of potential risks, appropriate controls and accountability for decisions about that use.

Together, these standards can help security, privacy and compliance teams address some practical questions. Do we have sufficient visibility of the information we hold, including employee and third-party data? Can we demonstrate why it is retained? Do we understand the restrictions that apply if it changes hands? And what assessments would be needed before that information could be used for a different purpose, such as AI training?

The proposed Spirit Airlines data sale illustrates why these questions matter. Corporate information can retain value long after its original purpose has ended, but that doesn’t remove the responsibilities associated with protecting it.

For organisations, the priority is to establish clear governance over data throughout its lifecycle, including the circumstances in which ownership, responsibility or intended use may change. That work needs to happen while the information is still under their control, rather than when a potential sale or transfer brings those questions into focus.