363 sale due diligence checklist: the data and records questions bidders skip

Why records need their own workstream in 363 diligence

In a section 363 sale, records questions have to be answered before the bid deadline, because the buyer usually takes the assets as is, with thin representations and little recourse after closing. A records workstream covers four areas: which systems and archives transfer, what the debtor's privacy commitments and the sale order allow for personal data, which customer and vendor consents exist, and whether the estate has already licensed any data.

Bidders tend to diligence contracts, receivables and inventory, and treat books and records as a closing deliverable. That works for a distributor's warehouse. It fails for a software, services or logistics debtor whose value sits in CRM history, support tickets, code repositories and finance systems, where one missing admin credential or one lapsed subscription can strip years of history out of the business you just bought.

Personal data adds a statutory layer. Under section 363(b)(1) of the Bankruptcy Code, if the privacy policy in effect when the case began prohibited transferring personally identifiable information to unaffiliated persons, the estate may sell or lease that information only consistently with the policy, or after the court appoints a consumer privacy ombudsman, holds a hearing and finds no showing that the sale would violate applicable nonbankruptcy law. That review can be demanding: in the 2025 23andMe case, the appointed ombudsman recommended that customers' genetic and personal data not be transferred without renewed opt-in consent.

The 363 records diligence checklist

Work through it with the debtor's banker in the first week of data room access. Every unchecked box becomes a question for debtor's counsel, a schedule in your markup of the purchase agreement, or a price adjustment.

Transfer scope: systems, archives and access

• The asset purchase agreement defines purchased books and records, and says whether that means live systems, archives and backups or only copies of records relating to the business.
• A schedule names each system that holds operating history (CRM, ERP or accounting, ticketing, email, chat, file shares, code repositories), with years of history for each.
• The account owner of record at each software vendor is known, and admin credentials pass to the buyer at closing.
• Each subscription holding the data is being assumed and assigned, or the debtor has committed to export it before any rejection takes effect.
• Legacy systems, retired servers, tape backups and departed employees' mailboxes are identified, along with who physically holds them.
• Records the estate keeps (tax files, litigation material, records needed for claims and avoidance actions) are listed, and the buyer's access rights after closing are written down.

Personal data and the sale order

• You have the privacy policy and customer notices in effect on the petition date, not just the current website version.
• You know whether a consumer privacy ombudsman has been or will be appointed, and you have read any report.
• The proposed sale order states the conditions attached to customer personal data, such as honoring the existing policy or notifying customers.
• Employee files, benefits data and any health information in HR systems are identified separately from customer data.
• Call recordings and transcripts are listed with the notices given when they were made.

Consents and third-party rights

• Customer contracts are checked for confidentiality and data-use clauses covering deliverables, tickets and shared files.
• Records the debtor holds for its own clients (as an outsourcer, agency or processor) are flagged as client data, not estate data.
• Content built by contractors, such as training material or code, is covered by written assignments.
• Vendor terms on data ownership, export formats and deletion after termination are reviewed for the main systems.
• For franchise systems, franchisor records are separated from franchisee-owned data; the franchisor bankruptcy brief covers that split.

Prior licenses and encumbrances

• The contracts list and the debtor's Schedule A/B intangibles entries are checked for data licenses, data-sharing deals and analytics agreements.
• Any existing AI-training license is read for exclusivity, term and field of use, since an exclusive license can bar the new owner from licensing the same records for that use until it expires.
• Lender liens over general intangibles, and how the sale order treats proceeds, are understood.
• Monthly operating reports are scanned for one-off license or data receipts that point to deals missing from the contracts list.

How to read the results

Red flags that should change the bid

• Nobody at the debtor can still run an export, or the IT lead has already left.
• Retention settings auto-delete mail or chat and were never paused at filing.
• Most of the value sits in consumer personal data or patient records, which carry the heaviest consent limits.
• The debtor's records are mostly its clients' data under contracts that bar reuse.
• A court, trustee or lender controls the systems and has not been told about the records question.

Where SourceX fits for advisors on either side

Records a buyer declines, or that are carved out of a piecemeal liquidation, stay with the estate. If the debtor is a US company with 50+ full-time employees at peak (contractors excluded), several years of documented operations and records it has the right to license, the trustee or debtor in possession may be able to license them through SourceX with court approval, adding recovery for creditors. The guide to structured dismissal after a 363 sale covers who holds leftover records once the sale closes.

For a partner, the sequence is the same whichever side you advise:

1. Raise the idea with the estate fiduciary and its counsel, then introduce them to SourceX through the referral form or your referral link.
2. SourceX checks headcount, operating history, breadth of records and rights with whoever can sign for the estate.
3. The estate completes a data inventory; a records inventory folder in the sale data room usually supplies most of it.
4. Price and terms are agreed, and estate counsel prepares the motion and proposed order.
5. Buyers review, the agreement is signed, and data is prepared under agreed redaction rules and delivered only after authorization.

You never export, upload or describe the records yourself. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed. If you are retained by the estate or act as a fiduciary, disclosure and court approval questions come first: read referral opportunities for M&A advisors and ask estate counsel before you register.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Next step

Run the debtor through the company fit checker for a preliminary, non-binding read, then register as a partner to make the introduction. A debtor, trustee or buyer that controls the records can also apply directly at sourcex.si/apply.