De-identifying company data for a bankruptcy sale

De-identification is what makes most data sales in bankruptcy workable. Buyers want how the work was done, not who did it, and removing identities is how the estate can sell value without selling people's privacy. This guide explains how it's done and how to describe it to a court.

General information, not legal advice.

What de-identification means here

There's no single legal definition that applies to all business data. Different laws use different standards: HIPAA has its own de-identification rules for health information, and state privacy laws define "deidentified data" in their own terms, often requiring reasonable measures, a public commitment not to re-identify, and contractual obligations on recipients.

For a bankruptcy data sale, the practical goal is: the delivered dataset shouldn't reasonably identify individuals, and the buyer is contractually barred from trying.

What gets removed or replaced

• Names of employees, customers, vendors and contacts
• Email addresses, phone numbers, street addresses
• Account, order, invoice and ticket numbers that link to people
• Government IDs and payment card data (usually excluded entirely)
• Customer and company names, where they're sensitive
• Signatures, photos and attachments that identify people

Identifiers are usually replaced with consistent placeholders, so "Person 14" in one message is the same person in the next. That keeps threads coherent, which is what makes the data useful, while removing the identity.

Free text is the hard part

Structured fields are easy. Emails, chat messages, tickets and documents are not. People write names in sentences, mention addresses in passing, and paste in customer details. A defensible method layers:

1. Automated detection of names, contact details and identifiers in free text.
2. Pattern rules for company-specific identifiers (customer numbers, project codes).
3. Human review of statistically meaningful samples.
4. Category exclusions for whole channels, folders or mailboxes that are too sensitive to process (HR, legal, health).

What stays out entirely

Some data is better excluded than de-identified:

• privileged communications with counsel,
• HR, payroll, medical and benefits records,
• material under NDAs or customer confidentiality terms,
• payment card and bank account data,
• children's data,
• and anything the lender, committee or ombudsman asks to exclude.

Contracts back up the technology

The license should require the buyer to:

• not attempt to re-identify individuals,
• not combine the data with other data to re-identify,
• limit use to the permitted purposes,
• secure the data and report incidents,
• and pass the same restrictions to anyone it shares with, if sharing is allowed at all.

Be honest about residual risk

No de-identification method reduces re-identification risk to zero, and claims that it does will undermine credibility with an ombudsman or court. The right statement is that risk has been reduced substantially through layered technical, human and contractual measures, and here's how.

How to describe it to the court

A good declaration explains, in plain language:

• what systems and date ranges are included,
• what's excluded and why,
• how identifiers are detected and replaced,
• how free text is handled,
• how quality was checked,
• and what contractual restrictions bind the buyer.

If an ombudsman is appointed, share the method early. Ombudsmen often accept a well-documented approach and may suggest refinements.

Who does the work

Either your team runs the export and de-identification using a defined playbook, or our engineers do it under confidentiality obligations, working from exports rather than live access where possible. In Chapter 7, the trustee decides. Either way, buyers see only redacted samples before approval and the de-identified dataset after the order.

Before you start

• Decide which systems are in scope.
• Pull the privacy policy and key customer contracts.
• Identify sensitive channels and folders to exclude outright.
• Agree the method with counsel before marketing.

That's what turns a privacy question into a paragraph in the motion instead of an objection at the hearing.

A worked example: one support ticket

Here is a simplified support ticket before and after the process.

Before: "Hi, this is Dana Ruiz from Hollow Creek Dental (acct #44817). Our scheduler crashed again after the update and we lost Tuesday's bookings. Call me at 304-555-0172."

After: "Hi, this is [PERSON_1] from [CUSTOMER_ORG_1] (acct [ACCOUNT_ID]). Our scheduler crashed again after the update and we lost [WEEKDAY]'s bookings. Call me at [PHONE]."

What remains is the substance a buyer values: a customer reports a crash after an update, there's data loss, and the agent's later reply shows how it was handled. What's gone is anything that points to a person or a customer. Consistent placeholders (PERSON_1 stays PERSON_1 throughout the thread) preserve the conversational structure without re-identifying anyone.

Validation and audit

A method is only as good as its testing. A defensible process includes:

1. Automated detection for names, emails, phone numbers, addresses, account and card numbers, government IDs and dates of birth.
2. Rule lists built from the company's own customer and employee lists, so known names are caught even in unusual formats.
3. Human sampling. Reviewers read a random sample of records after processing and log any misses. The miss rate should be documented.
4. Re-run and re-sample until the miss rate meets the agreed threshold.
5. A short written report that can be attached to the motion or given to an ombudsman.

That report is what lets counsel tell the court, accurately, what was done. It also feeds the analysis in the consumer privacy ombudsman guide. For how this protection is described to buyers and partners, see our security page.

Structured data needs a different approach

CRM, ERP and billing records are easier than free text in one way, since fields are labeled, and harder in another, since combinations of fields can identify someone. A record with a ZIP code, birth date and job title may identify a person even with the name removed. Good practice is to generalize quasi-identifiers (ZIP to region, dates to month or year, exact amounts to bands), drop fields buyers don't need, and test whether any combination of remaining fields is unique. Keep a field-by-field table of what was removed, generalized or kept; it becomes an exhibit for counsel and is the fastest way to answer an ombudsman's questions. For financial records, also consider whether invoice numbers, check numbers or bank references could be matched back to a customer by anyone holding the original books.

Finally, agree in advance who signs off. The debtor's officer, counsel, and the processing lead should each approve the final method in writing before any copy leaves the company's control.

Frequently asked questions

Is de-identified data still "personal information"?

It depends on the law and the method. Properly de-identified data, with contractual bans on re-identification, often falls outside definitions of personal information, but counsel should assess the specific statutes that apply.

Is pseudonymization enough?

Usually not by itself. Replacing names with codes while keeping a key, or leaving distinctive details in free text, can leave records re-identifiable. Removal plus contractual and technical controls is the safer standard.

Who sees the raw data?

Only the team doing the processing, under NDA and within the company's systems or a controlled environment. Buyers receive only processed copies, and only after the court order.

What about privileged documents?

They're excluded up front. Legal correspondence and privileged material should never be part of a data set offered for sale.

This guide is general information, not legal, tax or financial advice, and reading it does not create an attorney-client relationship. Bankruptcy outcomes depend on the facts, the court and the parties; nothing here promises price, timing or court approval. Talk to your bankruptcy counsel about your case.