By Palak Devpura
A shopping app shuts down after burning through its last round of funding. Its office is empty, its employees have left and its website is offline. But one valuable asset remains: a database containing years of customer names, contact details and purchasing habits.
Could the founders sell that database to pay creditors?
In business terms, information can be valuable. In legal terms, personal data is not an ordinary asset that can always be sold like office furniture.
The first question is what information the business collected and what customers were told would happen to it. A company may have collected email addresses to deliver orders, not to provide an unrelated advertiser with a ready-made marketing list. A proposed sale can raise questions about consent, transparency, purpose limits and legitimate grounds for processing.
READ: The startup raised millions. Why is the founder still broke? (November 4, 2026)
The answer also depends on the location of customers and the relevant law. In India, the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 establish a framework that includes phased commencement of major substantive obligations. Founders should check which provisions are in force at the relevant time, alongside existing contractual and sector-specific requirements. US businesses may face different federal and state privacy rules, and the promises in their privacy policies can matter greatly.
Selling an entire business is different from quietly exporting a spreadsheet of customer records. In an acquisition, a buyer may need customer information to continue providing an existing service. Even then, the parties must examine what transfers are permitted, whether individuals must be notified or given choices, and how the records will be protected.
READ: Your AI built the product. But can your startup really own it? (November 3, 2026)
Where the company is insolvent, formal proceedings may also affect who has authority to sell assets and how creditors are paid. Financial distress does not, by itself, remove privacy obligations.
There are smarter options than treating every record as inventory. A startup can assess whether data can be anonymised reliably, whether only business-level analytics can be sold, or whether a compliant business transfer is feasible. It should also delete information that it has no lawful reason to retain.
The lesson starts long before a shutdown. Businesses should maintain accurate privacy notices, track consent and contractual restrictions, and understand what information they have collected and why.
Customer data may help build a valuable company. But the fact that a startup possesses personal information does not mean it can sell that information to anyone when money runs out.
(Palak Devpura is co-founder of Spinach Laws, a startup-focused legal services firm advising founders on incorporation, brand protection and cross-border transactions. This column is part of the ongoing Spinach Laws × The American Bazaar series on law for founders.)