Data protection, records & access requests
Controller roles, secure preservation, subject access requests and the handling of case information.
Insolvency records often contain sensitive information about employees, customers, directors and creditors. Preserve and use that information lawfully, securely and for a defined purpose. An appointment does not make all company information public or remove individual rights.
Identify the role and purpose
Controller and processor status depends on who determines the purposes and means of the particular processing. Consider the company’s continuing role and any separate processing by the office-holder or firm. Appointment alone does not settle every role or transfer every liability.
Map where personal information is stored, why it is needed, the lawful basis and who may receive it. Statutory investigations and employment-claim work may justify particular uses, but do not justify unrelated disclosure or indefinite retention of everything.
Preserve evidence and protect access
Secure the systems and records needed for administration of the estate and possible proceedings. Control access, preserve relevant metadata and document transfers to advisers, purchasers and storage providers. Assess confidentiality, legal privilege and personal-data obligations before disclosure.
Balance record-retention duties with storage limitation. Record the reason for retention and how disposal will be controlled. A sale of a database requires an assessment of the proposed use and the information and rights of the people concerned.
Handle access requests as a distinct process
A subject access request concerns a person’s own personal data. It is not an automatic right to every document containing a name or a substitute for a creditor’s statutory information rights. Recognise requests even where no particular form or legal wording is used.
Use the ICO’s current guidance on identity, scope, searches, deadlines and any permitted clarification, extension or exemption. Record the search and the reason for any withholding. Consider other people’s data and protected information before supplying a response.
Technical detail
SAR in data protection means subject access request. SAR in financial-crime work means suspicious activity report. Keep the terms and the handling procedures distinct; the existence or content of an NCA report must not be disclosed casually in response to an access request.
Northern Ireland: source route
UK data-protection legislation also applies in Northern Ireland. Consider local insolvency record and court requirements alongside the ICO’s guidance. Separate statutory creditor information rights under Northern Ireland insolvency law from a request for an individual’s personal data under the UK GDPR.
Sources & review
Read the source in its own context. Legislation may contain commencement provisions and changes not yet applied to the displayed text. Professional guidance is identified separately from law.
Initial source-based editorial review: 26 Oct 2026. Next scheduled review: 26 Nov 2026. Substantive changes are reviewed before publication.
Added in the practice and regulation expansion requested on 26 October 2026. Primary-source editorial check; this is not independent professional approval. Future measures are distinguished from provisions in force.
Read the editorial approach and change policy.