The GDPR in Dutch bankruptcy proceedings: Personal data processing by the insolvency practitioner

When a company enters bankruptcy proceedings, the insolvency practitioner gains access to significant amounts of business information, much of which contains personal data. As a result, the insolvency practitioner becomes responsible not only for administering the estate, but also for ensuring that personal data is processed lawfully.

The practical importance of these issues has become particularly evident in healthcare insolvencies. In the recent Co-Med bankruptcy, one of the largest and most publicly debated healthcare insolvencies in the Netherlands, Rob Lemmens was the court-appointed insolvency practitioner. The administration of the estate, involving substantial volumes of sensitive medical and personal data, demonstrated the practical and legal challenges of balancing the statutory duties of an insolvency practitioner with the stringent requirements of the GDPR.

Under Dutch insolvency law, the court-appointed insolvency practitioner (curator) is regarded as the controller of personal data from the moment bankruptcy is declared. Consequently, securing records, reviewing documentation, investigating the causes of the bankruptcy, and communicating with stakeholders may all constitute processing within the meaning of the GDPR.

This dual responsibility presents a particular challenge in practice. On the one hand, the curator has a duty to preserve and realise the assets of the estate, investigate its financial affairs and act in the interests of creditors, and take into account the interest of various stakeholders. On the other hand, personal data may only be processed where a lawful basis exists and only to the extent necessary for a legitimate purpose. Fundamental GDPR principles, including transparency, proportionality, and data minimisation therefore remain fully applicable throughout the insolvency process.

These obligations have become increasingly important as businesses have become more digitalised. Corporate records now frequently include email archives, cloud-based storage environments, customer databases, and employee and client (or patient) records. This requires careful consideration of how personal data is secured, reviewed, retained, and ultimately deleted.

Although discussed from a Dutch perspective, the underlying challenge is international. Insolvency practitioners in many jurisdictions face the same combination of insolvency-related duties and privacy obligations. The Dutch experience demonstrates that data protection and insolvency law can no longer be viewed as separate disciplines, making careful handling of personal data an essential part of modern insolvency practice.

---

Rob Lemmens LLM MSc. is a partner at Thuis Partners Advocaten and specialises in insolvency and corporate law. He regularly acts as a court-appointed insolvency practitioner and advises on restructurings, directors’ liability, mergers and acquisitions, and corporate and commercial matters.