Bytes To Bankruptcies - Valuing Data As An Insolvency Asset In India’s Digital Age
Author: LawSphereX
Category: Corporate & Insolvency
Published:
Updated:
BYTES TO BANKRUPTCIES: VALUING DATA AS AN
INSOLVENCY ASSET IN INDIA’S DIGITAL AGE
Maanya Bhambal, OP Jindal Global University
ABSTRACT
In the era of the digital economy, data has emerged as an essential asset for contemporary businesses. As businesses expand and rely more on datadriven models, for consumer behavior analytics to algorithmic optimization, the valuation and treatment of data in insolvency is essential. But even as companies move toward data-intensive models, existing insolvency structures are still not well-suited to reflect the complexities of data ownership, transferability, and monetization. This article examines the conceptual and legal foundations of considering data as an insolvency asset based on corporate law, data protection frameworks, and insolvency jurisprudence.
It analyzes the extent to which traditional valuation techniques - such as the income approach, cost approach, and market approach - can be applied to data and addresses the conflict between asset maximization and right to privacy under laws such as India's Digital Personal Data Protection Act, 2023 and the EU's General Data Protection Regulation (GDPR). Finally, the essay contends for a balanced approach that acknowledges data as an asset in insolvency, ensuring that data protection obligations are met, and stakeholder interests are protected.
Introduction
The Growing Significance of Data as an Asset Data marks a revolutionary change in business value in the digital age. With digital transformation speeding up across industries, ranging from healthcare and finance to entertainment and logistics, businesses are becoming more and more dependent on data to create profits, gain competitive edge, and fuel innovation. Based on a World Economic Forum report in 20221, intangible assets, including data, now represent more than 90% of the S&P 500's market value, up from 17% in 1975. This development poses pressing questions for corporate and insolvency law: Should data be viewed as an asset in insolvency? And if so, how can data be valued, safeguarded, and transferred within legal constraints? Historical insolvency regimes are very much built on physical and fiscal assets - land, stock, plant and machinery.
Intangible assets like intellectual property have increasingly been incorporated into insolvency valuation frameworks, but data is a different story. While patents or trademarks are subject to well-defined legal protections and conveyance rights, data tends to lack well-defined proprietary boundaries. In addition, personal data is governed by strict regulatory frameworks, especially under legislation like the EU GDPR, California Consumer Privacy Act (CCPA), and India's DPDP Act, 2023, which restrict the commodification and transfer of personal data without clear consent. Recent high-profile insolvencies, for example, those involving Cambridge Analytica and FTX, have focused attention on such challenges. Here, regulators, creditors, and consumers have struggled with whether and how to sell or transfer customer data to creditors. United States Bankruptcy Court in Toysmart.
com LLC (2000) even refused to approve the sale of personal customer data breaching privacy promises, making an important precedent. 2 This essay critically assesses the handling of data as an asset in insolvency, examining the conflicts between the maximization of assets for creditors and compliance with legal requirements of privacy and protection of data. In a comparative approach, it borrows from the principles of insolvency law, developing valuation techniques, and global best practices. It finally contends that while data needs to be treated as an asset within insolvency proceedings,
1 World Economic Forum, ‘Publications’ (World Economic Forum26 June 2023)
.
2 House of Commons, ‘Disinformation and “Fake News”
Final Report Eighth Report of Session 2017-19 Report, Together with Formal Minutes Relating to the Report’ (2019) . so too must its treatment be moderated by a legal system guaranteeing ethical monetization, informed consent, and regulatory compliance. Development of Data-Driven Business Models Over the last few decades, there has been a profound shift in the operation of businesses - away from asset-intensive, old-fashioned models and towards data-centric, digitally led ones. In these newer systems, data is no longer a side-effect of operations but the key driver of decisionmaking, innovation, and revenue creation. Companies today apply customer data to fashion products, personalize user interactions, train AI models, and refine supply chains. Essentially, data has become an operational imperative and a strategic competitive differentiator.
Across the world, technology moguls such as Google, Amazon, Meta, and Alibaba are the best examples of this paradigm. Their main businesses revolve around gathering, analyzing, and selling user data. In India too, Reliance Jio, Zomato, Byju's, and Paytm operate on similar lines. For example, Reliance Jio used its access to huge datasets of consumer behavior to venture into e-commerce, entertainment, and finance. These forays were not just infrastructure-led, but data-led. This transformation is seen in contemporary valuation practices. As McKinsey Global Institute states in a 2021 report3, companies employing data-rich strategy exceed conventional firms in profitability and scalability. As of 2022, intangible assets such as data contributed more than 90% of the S&P 500 market value.
Hence, in instances of insolvency, how such intangible assets, particularly proprietary data, are treated has become a decisive issue among practitioners and policymakers. Overview of the Insolvency and Bankruptcy Code (IBC) Framework The Insolvency and Bankruptcy Code, 2016 (IBC)4 was brought to reform India's disconnected and inefficient insolvency framework. Its core goals are to encourage resolution rather than liquidation, optimize asset value, and achieve timely resolution of insolvency proceedings. The IBC defines "assets" very widely to cover both intangible and tangible property under Section
3 ‘The Data-Driven Enterprise of 2025’ (McKinsey & Company28 January 2022)
. 4 ‘Insolvency and Bankruptcy Board of India’ (Ibbi.gov.in2025) accessed 20 July 2025.
3(2). This gives a legislative foundation to bring data within insolvency proceedings—at least on paper. Notwithstanding this broad definition, the IBC does not categorically acknowledge data as an independent type of asset. It deals with only conventional assets like land, plant, equipment, and financial instruments. Intangible assets such as intellectual property (IP)—trademarks, copyrights, and patents—are occasionally transferred in resolution. But proprietary data such as customer databases, behavioral analytics, and usage logs have predominantly been kept in legal limbo. According to Section 18(f), the IRP has the power to take possession of "all assets" of the corporate debtor. But if these assets constitute personal data, then questions are raised if such data can be disposed of and sold freely to third parties without violating data protection legislation.
The lack of clear valuation parameters or regulatory pointers only adds to the difficulty of including data in asset resolution. This problem is especially urgent for data-intensive companies—like fintech startups, healthtech platforms, or online marketplaces—where proprietary data can constitute the majority of the firm's real market value. If the IBC framework does not adapt to the legal intricacies of dealing with data, creditors could be deprived of a big chunk of recoverable value in the process of insolvency. Digital Personal Data Protection Act (DPDP Act), 2023: A New Paradigm The Digital Personal Data Protection Act, 2023 (DPDP Act) ushers in an expansive regulatory framework for processing personal data in India. Although primarily aimed at protecting individual privacy rights, its provisions have a direct bearing on insolvency proceedings where data are a primary asset.
This new paradigm ensures that data cannot be transferred, processed, and sold freely in a resolution process without following the stringent requirements under the Act. One of the Act's defining aspects is its focus on consent-driven processing. According to Section 6, data fiduciaries must ensure that personal data is processed only for the reason for which clear and informed consent was received. This "purpose limitation" limits the use of data beyond its initial intention—even under insolvency. Thus, if customer or user information is to be passed on to a resolution applicant or buyer, either new consent is needed or a valid exemption to apply. Additionally, the Act places fiduciary duties on the entities that deal with personal data. These include data security, facilitating the exercising of rights by data principals (e. g. , access and correction), and data accuracy.
These do not lapse in the case of insolvency. In the case of a company in the process of insolvency, if it continues to process data or transfers data under its resolution plan, it is expected to do so under full conformity to these standards. The DPDP Act also imposes cross-border data transfer restrictions under Section 16. Data transfers are only permissible to notified countries or entities notified by the Central Government. The same becomes a material restriction in insolvency situations involving foreign resolution applicants or asset purchasers seeking to access or relocate data outside of India. These provisions shrink the group of potential bidders and desiccates liquidity of data assets. The DPDP Act is applied by the Data Protection Board of India, where non-compliance can attract penalties up to ₹250 crore.
Insolvency professionals shall thus make sure that any treatment or sale of data assets does not cause regulatory liability, further loading on the debtor's estate and defeating the purposes of insolvency resolution. Legal Tensions: Asset Maximization vs. Privacy Protection The fundamental purpose of the IBC is to optimize the value of assets of the corporate debtor to benefit its creditors. This asset-oriented objective, however, typically confronts the personoriented culture of the DPDP Act, which is in favor of privacy and consent over commodification. This confrontation is particularly conspicuous when individual data like customer profiles, health information, or financial histories is to be transferred or sold during insolvency. Take the case of an edtech startup that has gone into insolvency and has a rich user database.
Although this information can be important to a buyer, it could have been gathered merely for educational use, and not for marketing or resale. Moving such information without re-consent would contravene the DPDP Act, even if it benefits creditor recovery. There is also the issue of consent portability. The initial consent that the debtor gives might not be enforceable in the context of a resolution applicant. Fresh consent might have to be obtained from the courts and the regulators, which may slow down the process of insolvency and make the data asset less commercially appealing. Non-compliance with the regulations can also boomerang by devaluing assets. If the Data Protection Board files proceedings or issues penalties against unjustified data transfer, the resultant financial gain made from such transfers will be reversed.
Asset maximization must therefore be properly weighed against statutory privacy requirements. Valuation of Data as an Insolvency Asset It is inherently difficult to value data but crucial within insolvency. Standard valuation techniques—income approach, market approach, and cost approach—must be modified but with care. The income approach values future cash flows the data can produce, such as income from targeted ads or analytics services. The market approach looks at recent sales of similar data sets, and the cost approach calculates the cost to replicate the dataset from scratch. But, these techniques have been given a run. Here are three reasons why. Firstly, data quality and usability standards are highly relevant to one another—unusable, old, incomplete, or noncompliant data contributes very little to value.
Secondly, legal limitations such as consent and transfer under the DPDP Act can severely curtail usability and hence value. Thirdly, data lacks standardized benchmarks, so market comparison is not feasible. According to the IBC, registered valuers are required to value the assets of the corporate debtor, including intangibles. The Companies (Registered Valuers and Valuation) Rules, 20175 offer a regulatory framework, but there isn't sector-specific guidance on data valuation. There is an increasing requirement for a specialist methodology for valuing data in insolvency procedures. Regulatory and Compliance Challenges The co-existence of the IBC and the DPDP Act brings legal uncertainty for bidders and insolvency professionals. The laws, meant for varying policy purposes, can sometimes interfere with each other.
For example, whereas the IBC facilitates transfer of all assets of the debtor for maximizing recovery, the DPDP Act prohibits personal data from being transferred without
5 ‘THE COMPANIES (REGISTERED VALUERS and VALUATION ) RULES, 2017 1’
accessed 20 July 2025. reasonable legal ground. Resolution experts and Committee of Creditors (CoC) usually experience regulatory uncertainty about what information can be exchanged and on what terms. The uncertainty slows down resolution plan preparation, dissuades bidders, and may result in post-resolution court cases or regulatory fines. Absence of sectoral guidance also negates prompt decisionmaking and results in a delay in what is otherwise a time-bound insolvency resolution process. Examples from international markets provide cautionary tales. In the case of Toysmart. com (USA), the sale of individual customer information on bankruptcy was prevented because of prior privacy promises. Comparable scrutiny should ensue under India's DPDP regime. Compliance issues are therefore not hypothetical—they can have a material effect on deal structures, timing, and asset valuations.
6 Role of Experts and Valuers in Data Asset Management The valuation and administration of data assets in insolvency call for specialist, interdisciplinary knowledge. Traditional assets do not have layered complexities such as data— legal, technological, and ethical. Insolvency professionals hence need to draw upon experts from the industry, such as data scientists, privacy lawyers, and IT auditors, to determine data quality, legality, and usability. Under the IBC and the Companies (Registered Valuers and Valuation) Rules, 2017, only registered valuers with the Insolvency and Bankruptcy Board of India (IBBI) can value assets. Yet, there is no requirement for specialization in digital or data assets in the current framework. The qualifications must be revised to note the significance of data-based businesses.
Valuers should be independent, free from conflicts of interest, and apply methodological rigour. They are to expressly state the assumptions, legal restrictions, and technical considerations influencing the data's value. Transparency in valuation helps in establishing regulatory trust and preventing disputes in resolution.
6 ‘Decoding India’s Data Protection Act 2023’ (Ikigailaw.com4 August 2023)
accessed 20 July 2025.
Cross-Border Data Transfer Issues The DPDP Act's restriction on cross-border transfers (Section 16) is a significant hurdle to foreign buyers in Indian data assets insolvency proceedings. Personal data transfers are only allowed to those countries notified by the central government, and this restricts the base of eligible bidders in M&A and insolvency transactions with a global appeal. This prohibition can discourage overseas investment, particularly in areas such as fintech, ecommerce, and SaaS where data is the essence of value proposition. Resolution applicants might shortchange or withdraw bids because of non-transferability or lack of certainty concerning data localization. To overcome these challenges, measures like data ring-fencing, localized processing environments, or selling anonymized datasets are worth exploring.
Regulatory sandboxes and pre-authorizations from data protection authorities could also serve to resolve cross-border compliance issues. Anonymization provides a bridge of critique between the IBC's asset maximization objective and the DPDP Act's privacy safeguards. It removes personal identifiers from data sets, enabling businesses to maintain their analytical worth without trampling on individual rights. Data masking, differential privacy, and tokenization are standard methods. Implemented correctly, they can enable resolution applicants to reach commercially valuable data without soliciting consent. GDPR Recital 26 highlights the fact that anonymized data is outside the ambit of data protection legislation—a practice India could follow as well. Strong guidelines must, however, be formulated so that the anonymization is irreversible, and the risks of re-identification are very low.
Comparative International Perspectives International experiences are instructive. In the United States, the Toysmart. com insolvency case was a precedent where the FTC prevented customer data being sold because of earlier privacy commitments. In the EU, GDPR lays down rigid provisions on data transfer in insolvency, regularly mandating Data Protection Impact Assessments (DPIAs).
The UK's ICO has published guidance for insolvency practitioners on the legal processing of personal data. China's Cybersecurity Law limits cross-border transfer of essential data, affecting insolvency results in technology-intensive industries. 7 India may draw lessons from these jurisdictions through the formulation of sectoral protocols, portability of consent mechanisms, and regulator-approved templates of data handling to be applied in insolvency. 8 Conclusion With India's digital economy expanding, data will increasingly play a strategic role in insolvency. More data-intensive bankruptcies, more controversy over data transfer, and increased scrutiny of personal data resolution plans are all to be expected.
New technologies such as blockchain (for secure data tracks), AI (for valuation models), and smart contracts (for governance of consent) could potentially be used in insolvency administration. India can take the lead in the world by creating a legal framework that harmonizes insolvency, data protection, and digital innovation. In summary, the changing world of insolvency requires a harmonious legal regime—one that protects creditor rights without compromising individual privacy and moral limits. Information can and ought to be used as an asset in insolvency, but strictly within the bounds of legitimate and equitable use. Going ahead, coordination among insolvency, data protection, and sectoral regulators will be crucial.
With careful reforms and prudent practice, India can become the world's best model for handling data assets in corporate distress preserving value, privacy, and national interest in equal proportions. 7 ICO, ‘Data Sharing: A Code of Practice’ (ico. org. uk26 May 2023) .
8 ‘Toysmart.com, LLC, and Toysmart.com, Inc.’ (Federal Trade Commission10 July 2000)
accessed 20 July 2025.