Company data in a US bankruptcy: section 363 sales and the consumer privacy ombudsman

This page is general information, not legal advice. It does not describe what any court has decided in a particular case. Ask your own counsel.

If you are a chapter 7 trustee or a chapter 11 debtor in possession, company data may be property of the estate if the debtor holds rights in it that can be transferred. A sale or lease outside the ordinary course needs notice and a hearing, and it must meet the Code’s other conditions and other applicable law. When the conditions in section 363(b)(1) apply, a sale or lease must be consistent with the policy, or follow the court-approval route after appointment of a consumer privacy ombudsman.

This page gives you a five-question path to see which case you are in, and what to prepare. Then it shows how to see which AI data buyers fit the company.

Selling or leasing company data under section 363: what to check first

• Some company data sits outside the ombudsman rule. The rule is about personal information that individuals gave the debtor to get a product or service for personal, family or household use, under a policy that said it would not be passed to unaffiliated parties.
• Even where the ombudsman rule does not apply, a sale or lease outside the ordinary course of business still needs notice and a hearing, and other privacy law can still apply.
• If the court must hold the section 363(b)(1)(B) hearing, section 332(a) requires the ombudsman to be appointed no later than 7 days before the hearing, and requires timely notice to the ombudsman. Plan your timeline around it. Ask counsel about the separate notices to creditors and the U.S. Trustee.
• One application checks the company against every buyer we work with. No files and no company records are needed to start.

Five questions: does a data sale need a consumer privacy ombudsman?

Does a sale or lease of company data need a consumer privacy ombudsman?

Question	Where it comes from	If yes	If no
1. Are you proposing to sell or lease estate property outside the ordinary course of business?	11 U.S.C. section 363(b)(1)	Notice and a hearing are needed. Go to question 2.	An ordinary-course deal can go ahead without notice and a hearing only if the business is still authorized to operate and the court has not ordered otherwise (section 363(c)(1)). Ask counsel whether this deal is ordinary course.
2. Does the data include personally identifiable information as the Code defines it?	11 U.S.C. section 101(41A)	Go to question 3.	The ombudsman rule does not reach this data. Other privacy law may still apply.
3. Did the debtor, in connection with offering a product or a service, disclose to an individual a policy that prohibits transferring that information to persons not affiliated with the debtor, and was it in effect on the date the case began?	11 U.S.C. section 363(b)(1)	Go to question 4.	The ombudsman condition in section 363(b)(1) is not triggered. Other privacy law may still apply.
4. Is the proposed sale or lease consistent with that policy?	11 U.S.C. section 363(b)(1)(A)	That meets the privacy-policy condition in section 363(b)(1)(A). The deal still needs the rest of the section 363 process, authority over the data, and compliance with contracts and other law.	Go to question 5.
5. Can the court approve it after appointing a consumer privacy ombudsman?	11 U.S.C. sections 363(b)(1)(B) and 332	The court must still approve after notice and a hearing, giving due consideration to the facts, circumstances and conditions of the sale or lease, and finding that no showing was made that it would violate applicable nonbankruptcy law.	The trustee may not sell or lease the personally identifiable information.

1. Are you proposing to sell or lease estate property outside the ordinary course of business?

Where it comes from

11 U.S.C. section 363(b)(1)

If yes

Notice and a hearing are needed. Go to question 2.

If no

An ordinary-course deal can go ahead without notice and a hearing only if the business is still authorized to operate and the court has not ordered otherwise (section 363(c)(1)). Ask counsel whether this deal is ordinary course.

2. Does the data include personally identifiable information as the Code defines it?

Where it comes from

11 U.S.C. section 101(41A)

If yes

Go to question 3.

If no

The ombudsman rule does not reach this data. Other privacy law may still apply.

3. Did the debtor, in connection with offering a product or a service, disclose to an individual a policy that prohibits transferring that information to persons not affiliated with the debtor, and was it in effect on the date the case began?

Where it comes from

11 U.S.C. section 363(b)(1)

If yes

Go to question 4.

If no

The ombudsman condition in section 363(b)(1) is not triggered. Other privacy law may still apply.

4. Is the proposed sale or lease consistent with that policy?

Where it comes from

11 U.S.C. section 363(b)(1)(A)

If yes

That meets the privacy-policy condition in section 363(b)(1)(A). The deal still needs the rest of the section 363 process, authority over the data, and compliance with contracts and other law.

If no

Go to question 5.

5. Can the court approve it after appointing a consumer privacy ombudsman?

Where it comes from

11 U.S.C. sections 363(b)(1)(B) and 332

If yes

The court must still approve after notice and a hearing, giving due consideration to the facts, circumstances and conditions of the sale or lease, and finding that no showing was made that it would violate applicable nonbankruptcy law.

If no

The trustee may not sell or lease the personally identifiable information.

Statutory wording reproduced with list-introducing dashes changed to colons and quotation marks normalized.

11 U.S.C. section 363(b)(1). Source: United States Code, 11 U.S.C. 363, Office of the Law Revision Counsel, U.S. House of Representatives, read October 30, 2026; current through Public Law 119-136 (October 22, 2026).

(b)(1) The trustee, after notice and a hearing, may use, sell, or lease, other than in the ordinary course of business, property of the estate, except that if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless:

(A) such sale or such lease is consistent with such policy; or

(B) after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease:

(i) giving due consideration to the facts, circumstances, and conditions of such sale or such lease; and

(ii) finding that no showing was made that such sale or such lease would violate applicable nonbankruptcy law.

11 U.S.C. section 101(41A). Source: United States Code, 11 U.S.C. 101, Office of the Law Revision Counsel, U.S. House of Representatives, read October 30, 2026; current through Public Law 119-136 (October 22, 2026).

(41A) The term “personally identifiable information” means:

(A) if provided by an individual to the debtor in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes:

(i) the first name (or initial) and last name of such individual, whether given at birth or time of adoption, or resulting from a lawful change of name;

(ii) the geographical address of a physical place of residence of such individual;

(iii) an electronic address (including an e-mail address) of such individual;

(iv) a telephone number dedicated to contacting such individual at such physical place of residence;

(v) a social security account number issued to such individual; or

(vi) the account number of a credit card issued to such individual; or

(B) if identified in connection with 1 or more of the items of information specified in subparagraph (A):

(i) a birth date, the number of a certificate of birth or adoption, or a place of birth; or

(ii) any other information concerning an identified individual that, if disclosed, will result in contacting or identifying such individual physically or electronically.

11 U.S.C. section 332. Source: United States Code, 11 U.S.C. 332, Office of the Law Revision Counsel, U.S. House of Representatives, read October 30, 2026; current through Public Law 119-136 (October 22, 2026).

(a) If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint, not later than 7 days before the commencement of the hearing, 1 disinterested person (other than the United States trustee) to serve as the consumer privacy ombudsman in the case and shall require that notice of such hearing be timely given to such ombudsman.

(b) The consumer privacy ombudsman may appear and be heard at such hearing and shall provide to the court information to assist the court in its consideration of the facts, circumstances, and conditions of the proposed sale or lease of personally identifiable information under section 363(b)(1)(B). Such information may include presentation of:

(1) the debtor’s privacy policy;

(2) the potential losses or gains of privacy to consumers if such sale or such lease is approved by the court;

(3) the potential costs or benefits to consumers if such sale or such lease is approved by the court; and

(4) the potential alternatives that would mitigate potential privacy losses or potential costs to consumers.

(c) A consumer privacy ombudsman shall not disclose any personally identifiable information obtained by the ombudsman under this title.

What “personally identifiable information” means for the ombudsman rule

The definition in section 101(41A) is narrow. It covers information an individual provided to the debtor in connection with obtaining a product or a service from the debtor primarily for personal, family or household purposes. It lists a name, the address of a place where the person lives, an electronic address such as an email address, a telephone number for reaching the person there, a social security number and a credit card account number. When one of those items is present, it also covers a birth date, a birth or adoption certificate number, a place of birth, and any other information about the identified individual that, if disclosed, will result in contacting or identifying them physically or electronically.

Business-customer and staff data may fall outside the narrow definition in section 101(41A), depending on how it was collected and used. Other privacy, employment, sector and contract rules may still apply. Counsel decides which of your datasets are outside. This path tells you only whether the ombudsman rule is in play.

What a consumer privacy ombudsman does

Section 332 says that if the court must hold a hearing under section 363(b)(1)(B), the court orders the United States trustee to appoint one disinterested person, other than the United States trustee, as the consumer privacy ombudsman, no later than 7 days before the hearing begins. The court also requires timely notice of the hearing to the ombudsman. The ombudsman may appear and be heard at the hearing and provides information to help the court consider the proposed sale or lease. That information may include the debtor’s privacy policy, the potential losses or gains of privacy to consumers, the potential costs or benefits to consumers, and the potential alternatives that would mitigate privacy losses or costs. The court decides the motion. The ombudsman does not approve the sale. The ombudsman may not disclose any personally identifiable information obtained in the role.

What to prepare before you propose a sale

1. Sort the data. List each dataset and mark whether it holds personally identifiable information as section 101(41A) defines it.
2. Find every policy. Collect the privacy policies and notices the debtor published, with the dates and versions. Find the one in effect on the date the case began.
3. Read what it says about transfer. Does it prohibit transferring information to parties that are not affiliated with the debtor? Does it mention transfer in a sale or bankruptcy?
4. Compare the deal. Set out what the buyer or licensee would do with the data, and whether that is consistent with the policy.
5. Build the timeline. If an ombudsman is needed, the appointment comes first. Work back from the hearing date, and ask counsel how the request for the appointment is made.
6. Prepare the facts for the court and the ombudsman. The buyer’s identity and use, the commitments it will make, what will be deleted, and how individuals are told.

For what a buyer will want to see, read preparing a data room for an AI data buyer.

Common questions about company data in a section 363 sale

Does every sale of company data need an ombudsman?

No. The ombudsman step depends on the questions above. Counsel decides how they apply to your data.

Does a license count as a sale or lease?

Section 363(b)(1) speaks of selling or leasing. Whether a data license is treated as either is a question for counsel.

Can a court appoint an ombudsman when the conditions are not met?

That is a question for counsel. Ask what judges in your district do.

What does it cost to check?

You pay OpenTrain nothing.

Sources

• 11 U.S.C. section 363. Office of the Law Revision Counsel, U.S. House of Representatives.
• 11 U.S.C. section 332, consumer privacy ombudsman. Office of the Law Revision Counsel, U.S. House of Representatives.
• 11 U.S.C. section 101(41A), personally identifiable information. Office of the Law Revision Counsel, U.S. House of Representatives.
• 11 U.S.C. section 1107. Office of the Law Revision Counsel, U.S. House of Representatives.

Sources: Business Insider, 'AI labs are fueling a wild market for your Slack DMs', October 13, 2026. Read October 24, 2026.