The Insolvency of AI Companies: Are Datasets “Assets” under the IBC?

[Khushi and Lakshay are students at Christ (Deemed to be University), Delhi NCR.]

When an artificial intelligence (AI) startup enters the corporate insolvency resolution process (CIRP) under the Insolvency and Bankruptcy Code 2016 (IBC), its most valuable holding is rarely the office lease or the laptops sitting in a cupboard. Rather, it comprises the training corpus, user prompt logs, and licenses obtained under the Digital Personal Data Protection Act 2023 (DPDP Act). The committees of creditors (CoC) and resolution professionals (RPs) are increasingly asked to monetise and value these holdings as ordinary intangible assets. While insolvency practice in India has thus far treated data as an asset without considering whether privacy law even permits its transfer, this is particularly significant for AI companies, whose business models hinge on personal data.

Data as “Property” under IBC

Section 36(3) of the IBC defines the liquidation estate. It includes intangible assets, a category that extends beyond intellectual property to include financial instruments, securities, insurance policies, and contractual rights. It further sweeps in any other property belonging to or vested in the corporate debtor. Neither the IBC nor the CIRP regulations carve out personal data as a special case. Indian insolvency jurisprudence has largely developed around land, plant, machinery, and shareholding, and it has not yet been tested against a dataset.

The RP’s duty under Section 25 to preserve and protect the assets of the corporate debtor, and the CoC's mandate under Section 30(2), is to maximise value through a resolution plan. Both assume that whatever sits on the balance sheet can be handed over to a resolution applicant. This assumption holds true for a conventional manufacturing company. However, for an AI company, its validity depends on whether the underlying data can be regarded as asset belonging to corporate debtor.

Consent is a Licence, Not a Title

The DPDP Act builds its whole architecture around a data fiduciary that processes the personal data of a data principal for a specified purpose, based on the consent that is free, specific, and informed. Two features of this design matter significantly for insolvency. First, Section 6(6) obliges a data fiduciary to stop processing data within a reasonable time once a data principal withdraws consent. Second, Section 8(7) requires erasure of personal data once the specified purpose is no longer being served. Unlike the General Data Protection Regulation (GDPR), the DPDP Act does not recognise legitimate interest or contractual necessity as standalone lawful basis. Therefore, an Indian AI startup cannot usually fall back on those grounds to justify continued retention once its original commercial purpose, running the business as a going concern, has ended in liquidation.

This has a very specific consequence. Consent under the DPDP Act is best understood as a conditional, purpose-bound running between a named data principal and a data fiduciary. It is not a proprietary right that vests in the corporate debtor and can be reassigned to whoever buys the business. A resolution applicant stepping into the shoes of the insolvent AI company is, functionally, a new data fiduciary. Nothing in the DPDP Act treats a change of control, or a sale of business under a resolution plan, as an automatic transfer of the underlying consent. The IBC's asset transfer machinery and the DPDP Act's purpose and consent machinery are, in this sense, talking past each other.

The Missing Jurisprudence

Indian insolvency law has recognised intangible assets; however, no clear guidelines have emerged in Indian jurisprudence regarding when data can be classified as an insolvency asset. Section 36(3) of the IBC defines a liberal view of the liquidation estate, explicitly including intangibles and other property of the corporate debtor. Similarly, Sections 18(f) and 25(2)(a) of the IBC mandate the insolvency professional to take control and custody of assets of the corporate debtor. The decision of the Supreme Court in Victory Iron Works Limited v. Jitendra Lohia (2023), is an essential legal principle in support of this provision. According to the court, the bundle of development rights and interests created in favour of the corporate debtor was held to be “property” under Section 3(27) of the IBC, and hence “an asset” under Sections 18(f) and 25(2)(a). It was stressed by the court that “asset” was not defined under the IBC, and the bundle of rights of a corporate debtor might still be an asset even if the property belonged to another entity.

An analogous issue is seen in the case of CIRP of Think & Learn Private Limited, the holding company of BYJU's, which demonstrates that digital companies can be dependent on infrastructure that is under the control of third parties. The NCLT, in Amazon Web Services India Pvt. Ltd. v. Think & Learn Private Limited, decided whether AWS was entitled to claim a payment of cloud services rendered to Think & Learn Private Limited during the moratorium period under Section 14(2A) of the IBC, but did not determine whether the data stored thereupon was an “asset” under Sections 18(f) and 25(2)(a).

Separately, Karvy Data Management Services Limited, a company providing Aadhaar and KYC services to UIDAI and SEBI as clients, underwent all of the CIRP process as a truly data-oriented company, with its resolution plan sanctioned by the NCLT Hyderabad in December 2024 and the company sold as a going concern.

However, none of these processes resolve the question that is of relevance to this article, and which is as follows: is a dataset that contains personal data itself transferable property of the corporate debtor under the IBC, or do the restrictions on the transfer imposed by the DPDP Act fall entirely outside of this definition? Victory Iron Works suggests that intangible rights that may qualify as “property” can become part of the assets of the IBC. AWS suggests that a going concern valuation of a digital entity depends on third-party cloud computing services. Karvy suggests that even a company that is based primarily on data processing can undergo CIRP and get resolved as a going concern. However, none of them settles whether personal data held within the dataset is transferable asset property of the corporation in insolvency proceedings, or whether powers of custody and control are enough to enable the processing or transferring of it under India's data protection regime. And there is the gap in jurisprudence: the Indian tribunals have developed a wide definition of assets controlled by the RP based on custody without ever asking the question whether personal data qualifies as such an asset.

Comparative Signals the IBC has not Absorbed

Several jurisdictions have already confronted this challenge, and have regulated through imposing conditions under which personal data may be transferred, thereby rejecting that the data constitutes as a freely transferable property.

In the United States, the Federal Trade Commission was against Toysmart.com in their bankruptcy case Federal Trade Commission v. Toysmart.com, Inc, as it prohibited a standalone sale of the data and allowed transfer only as part of the business and subject to the initial privacy policy of the company. Congress mandated a consumer privacy ombudsman where a transfer is planned.

A similar example can be found in the United Kingdom. Green v SCL Group Ltd and Others is a case related to the insolvency of Cambridge Analytica, where it has been held that administrators do not become data controllers through their appointment. At the same time, the Information Commissioner's Office recommends selling the marketing database in insolvency only to the party using it in its initial manner. Neither measure of an ombudsman nor purpose match is in place under the IBC and the IBBI's CIRP regulations.

Applying this framework to five categories of AI-related data shows differing degrees of encumbrance.

Training datasets, scraped or licensed from third parties, are doubly encumbered. They are bound by the licensor's contractual terms, and, where they contain personal data, by DPDP consent and purpose limitation as well. A resolution applicant acquiring the corporate debtor does not automatically acquire a fresh, unencumbered right to process that data.

Fine-tuned models present an even more complex problem as the personal data can be memorised within model weights. This means the model itself can become a vector for re-identification even after the original dataset has been deleted. Indian law has no equivalent to the GDPR's guidance on anonymisation thresholds, and it remains doctrinally unclear whether a model weight even counts as personal data, a question the IBC's asset test never asks in the first place.

User prompts logged during the AI company's operation are personal data belonging to the company's customers and are generated for the specific purpose of receiving the service. Transferring the same data to a resolution applicant pursuing a different purpose would, on the ICO's purpose-matching logic, require fresh notice and consent.

DPDP consent based licences are, as argued above, non-transferable as a matter of statutory design. What transfers, at most, is the corporate debtor's back-end infrastructure, not the data principal's actual consent.

Synthetic datasets, though often marketed as clean of privacy encumbrance, may still be derivative of the personal data used to train the generative process. Indian law offers no safe harbour test, comparable to the identifiability thresholds recognised elsewhere, for deciding when a synthetic dataset stops being personal data.

Conclusion

The IBC's asset definition is possessory and title-based. The DPDP Act's consent architecture is purpose-based and revocable. Where an AI company's principal assets are derived from data, these two frameworks do not just sit side by side awkwardly, rather they can produce irreconcilable outcomes. The RP's duty to preserve value under Section 25 may require retaining exactly the data that Section 8(7) of the DPDP Act requires to be erased.