Introduction
When a company enters a Corporate Insolvency Resolution Process (“CIRP”), control over its affairs undergoes a significant change. Section 17 of the Insolvency and Bankruptcy Code, 2016 (“IBC“) vests management of the Corporate Debtor (“Corporate Debtor”) with the Interim Resolution Professional (“IRP“), suspends the powers of the board, requires officers and managers of the CD to provide records, and permits access to electronic records and books of account.[1] Section 18 of the IBC requires the IRP to collect information on the company’s assets, finances and operations and to receive and collate creditors’ claims. Once appointed, the Resolution Professional (“RP“) conducts the CIRP, controls the business records, maintains claims, prepares the Information Memorandum (“IM“) and manages the process for inviting resolution plans[2]Information therefore moves through the CIRP from the moment control changes.
Those records may contain personal data of employees, customers, homebuyers, guarantors, directors and individual creditors. The Digital Personal Data Protection Act, 2023 (“DPDP Act“) defines a “Data Principal” as the individual to whom the personal data relates, a “Data Fiduciary” as the person who determines the purpose and means of processing personal data, and a “Data Processor” as a person who processes personal data on behalf of a Data Fiduciary[3]The definitions and provisions establishing the Data Protection Board of India (“Data Protection Board“) came into force on November 13, 2025. The principal provisions governing processing, Data Fiduciary obligations, individual rights and exemptions are scheduled to commence on May 13, 2027.[4] A CIRP conducted during this transition may create records and data-room copies that would continue to remain in use after data protection obligations become operative.
Tracing Responsibility Through the CIRP
Customer and employee databases ordinarily remain within the Corporate Debtor’s systems after management shifts to the IRP and subsequently, the RP. CIRP-specific datasets also emerge through claims registers, forensic reviews, bidder eligibility checks and preparation of the IM. Insolvency professionals, their advisers, claims management platforms and virtual data-room providers may also access or process parts of this information. Since the DPDP Act links Data Fiduciary status to the determination of purpose and means, responsibility can be mapped by processing activity, the decision-maker and the service provider. The resulting map can travel with the information as the process moves into claims verification and bidder diligence. Engagement letters and technology contracts can mirror that map by stating permitted uses, access rights, incident escalation, retention instructions and deletion obligations for personal data handled by advisers and service providers[5] Where the Corporate Debtor already uses cloud or outsourced platforms, the same map can identify
which provider holds which category of personal data, the contractual basis for access, the person authorised to issue instructions during CIRP and the point at which access should cease or be renewed.
Claims as the First Data-Intensive Stage
Creditors may submit contracts, bank statements, invoices, identity documents and correspondence in support of their claims. The Insolvency and Bankruptcy Board of India (Insolvency Resolution Process for Corporate Persons) Regulations, 2016 (“CIRP Regulations“) require the IRP or RP to verify claims. Regulation 13 of the CIRP Regulations requires a maintenance of a list of creditors , the amounts claimed, the amounts admitted and security interests. It also provides for specified inspection rights, display on the Corporate Debtor’s website, where one exists, filing on the electronic platform of the Insolvency and Bankruptcy Board of India (“IBBI“), and filing with the Adjudicating Authority[6]
The supporting evidentiary file may contain substantially more personal information than the creditor list. Section 17(1)(a) of the DPDP Act addresses processing necessary for enforcing a legal right or claim. Section 17(1)(f) of the DPDP Act addresses processing for ascertaining the financial information, assets and liabilities of a person who has defaulted on a loan or advance from a financial institution, and expressly adopts the IBC meanings of “default” and “financial institution”. Section 17(1) preserves Section 8(1), which maintains the Data Fiduciary’s responsibility for compliance, and Section 8(5), which requires reasonable security safeguards[7] The creditor list and the supporting evidence can accordingly follow different access paths, with statutory fields entering the said creditor list and bank statements, identity documents and correspondence remaining in a controlled claims repository. That separation prepares the record for the wider disclosure required during resolution planning.
The Information Memorandum and Bidder Diligence
Regulation 36 of the CIRP Regulations requires the IM to contain extensive information about the Corporate Debtor. Depending on the case, it may include financial statements, creditor details, guarantees, names and addresses of certain members or partners, material litigation, employee liabilities, key employees, key customers and details of allottees in a real estate project[8]Section 29 of the IBC gives resolution applicants access to relevant information subject to undertakings concerning confidentiality, insider trading, intellectual property and onward sharing. Regulation 36A of the CIRP Regulations requires confidentiality commitments at the expression-of-interest stage, while Regulation 36B provides for the IM to be issued to eligible resolution applicants[9]
As due diligence progresses, a bidder’s need for detailed information may increase. Payroll exposure can first be examined through aggregate figures, customer concentration through categories and
receivables through masked schedules. Identified contracts or account-level records may later become relevant to valuation, operational continuity or implementation of a resolution plan. The data room can therefore move from aggregated or masked information to identified information as the diligence purpose becomes more specific. Once the relevant provisions of the Digital Personal Data Protection Rules, 2025 (“DPDP Rules“) commence, Rule 6 will require safeguards including encryption or masking, access controls, logs, monitoring, backups and contractual protections for Data Processors. These measures can be built into data-room permissions and access protocols[10]
Security, Retention and the Resolution Handover
The transfer of management may coincide with employee departures, vendor changes and uncertain system credentials. Administrator accounts, cloud platforms, shared drives, backups and third-party service providers can be identified when the RP secures bank accounts, contracts and business records. Rule 6 of the DPDP Rules provides a framework for that exercise once effective. Rule 7 of the DPDP Rules will require notice of a personal data breach to affected Data Principals without delay and an intimation to the Data Protection Board, followed by specified information within seventy-two hours, subject to any permitted extension.[11] System ownership, privileged access and incident escalation can therefore form part of the CIRP handover record.
Different records also acquire different retention purposes as the CIRP advances. Claim documents support verification, committee records evidence decisions, IM material supports valuation, and bidders may hold diligence copies. Section 31(3)(b) of the IBC requires the RP, after approval of the resolution plan, to forward all records relating to the CIRP and the resolution plan to IBBI for its database.[12]>Sections 8(7) and 12(3) of the DPDP Act recognise retention required for compliance with law, while Rule 8(3) of the DPDP Rules provides for minimum retention of specified processing data and logs for one year, subject to longer retention required by law[13]A retention schedule can distinguish the statutory insolvency record from working files, duplicate data-room material and bidder downloads.
Section 17(1)(e) of the DPDP Act addresses processing necessary for specified court or tribunal approved scheme of compromises, arrangements, mergers, amalgamations, reconstructions, demergers and transfers of undertaking. Its relevance to an IBC resolution depends on the legal structure used to implement the approved plan[14] Where operational datasets move to a successful resolution applicant or reorganised business, the handover can record processing purposes, processors holding copies, access rights, retention periods, known incidents and pending Data Principal requests. Data governance can then accompany the transfer of operations, contracts and assets.
A Data Protocol Embedded in the CIRP
By the time a CIRP moves from control to claims, from claims to the IM, and from diligence to implementation, the same information may have passed through several systems and recipients. The IBC and the CIRP Regulations establish why that information is collected, verified, preserved and disclosed. The DPDP framework adds obligations for the personal data carried within those records as its substantive provisions take effect. Recording responsibility, access, security, retention and handover at each statutory stage allows the data trail to remain aligned with the CIRP itself and gives the resolved business a defined record of the information it receives.
[1] Insolvency and Bankruptcy Code, No. 31 of 2016, § 17(1)–(2) (India).
[2] Insolvency and Bankruptcy Code, No. 31 of 2016, §§ 18(a)–(b), 25(2)(a), (d), (h) (India).
[3] Digital Personal Data Protection Act, No. 22 of 2023, § 2(i)–(k) (India).
[4] Ministry of Electronics & Information Technology, Notification G.S.R. 843(E), Gazette of India, Extraordinary, pt. II, sec. 3(i) (Nov. 13, 2025) (India).
[5] Digital Personal Data Protection Act, No. 22 of 2023, § 8(1)–(2), (5) (India) (effective May 13, 2027).
[6] Insolvency & Bankruptcy Board of India (Insolvency Resolution Process for Corporate Persons) Regulations, 2016, reg. 13(1)–(2) (India) (as amended June 9, 2026)
[7] Digital Personal Data Protection Act, No. 22 of 2023, §§ 8(1), (5), 17(1)(a), (f) (India) (effective May 13, 2027)
[8] Insolvency & Bankruptcy Board of India (Insolvency Resolution Process for Corporate Persons) Regulations, 2016, reg. 36(2) (India) (as amended June 9, 2026)
[9] Insolvency and Bankruptcy Code, No. 31 of 2016, § 29(2) (India); Insolvency & Bankruptcy Board of India (Insolvency Resolution Process for Corporate Persons) Regulations, 2016, regs. 36A(7)(g), 36B(1) (India).
[10] Digital Personal Data Protection Rules, 2025, r. 6(1)(a)–(g), Gazette of India, Extraordinary, pt. II, sec. 3(i), G.S.R. 846(E) (Nov. 13, 2025) (India) (effective May 13, 2027).
[11] Digital Personal Data Protection Rules, 2025, r. 7(1)–(2), Gazette of India, Extraordinary, pt. II, sec. 3(i), G.S.R. 846(E) (Nov. 13, 2025) (India) (effective May 13, 2027)
[12] Insolvency and Bankruptcy Code, No. 31 of 2016, § 31(3)(b) (India)
[13] Digital Personal Data Protection Act, No. 22 of 2023, §§ 8(7), 12(3) (India), Read HERE; Digital Personal Data Protection Rules, 2025, r. 8(3) (India) (effective May 13, 2027)
[14] Digital Personal Data Protection Act, No. 22 of 2023, § 17(1)(e) (India) (effective May 13, 2027)