GDPR and selling debt: your data protection duties when you assign a receivable

When you sell a debt, you are not only transferring a right to be paid — you are also handing over personal data about the debtor. That brings the UK GDPR and the Data Protection Act 2018 into play. Handling it correctly protects you legally and reassures buyers. Here is what creditors and buyers need to know.

Why data protection applies

A debt file typically contains personal data: names, addresses, contact details, financial information and correspondence. Transferring that file to a buyer is a form of processing personal data, so both seller and buyer have obligations under the UK GDPR.

The lawful basis for sharing debtor data

You need a lawful basis to transfer the data. In debt sales this is usually legitimate interests: the creditor's legitimate interest in recovering money owed, and the buyer's legitimate interest in collecting the debt they have bought. This basis must be balanced against the debtor's rights and reasonable expectations.

Recovering a lawful debt is a well-recognised legitimate interest — but it does not remove the need to handle the data fairly and securely.

Data minimisation: share only what is needed

• At the listing stage, share no personal data at all — describe the debt anonymously.
• During negotiation, share only what a serious buyer genuinely needs to assess the debt.
• At completion, transfer the full file to the confirmed buyer under the deed of assignment.

Transparency and the debtor's rights

Debtors have rights under the GDPR, including to be informed about how their data is used. Privacy notices should generally allow for the possibility that a debt may be assigned. After the sale, the buyer becomes a controller and must handle the data lawfully, including responding to the debtor's data rights.

Practical steps for a compliant sale

1. Keep personal data out of the public listing.
2. Share files securely — encrypted or via a controlled channel, not open email attachments where avoidable.
3. Only disclose to genuine, engaged buyers, ideally under a confidentiality understanding.
4. Document your legitimate interests assessment for the transfer.
5. Ensure the buyer is a credible controller who will handle the data properly.

➜ Sell my debt from £19.90

What buyers should check

Buyers should confirm the seller had the right to transfer the data, keep the information secure, use it only to collect the specific debt, and be ready to meet the debtor's data rights. Good data practice is part of good due diligence.

Conclusion

Selling a debt involves personal data, so the UK GDPR applies — but the obligations are entirely manageable. Rely on legitimate interests, minimise what you share, keep transfers secure and deal only with credible buyers. Handle the data properly and the sale is both lawful and smooth. This article is general guidance, not legal advice.