Personal information that is held in a database should not normally be sold if patients have not been told originally that their information could be passed on to other organisations. However, if the business becomes insolvent, bankrupt or is being closed down or sold, the Data Protection Act will not prevent the sale of a database containing the details of individual patients, providing the transfer is made on terms which are of a kind approved by the Information Commissioner. This must ensure that there are adequate safeguards for the rights and freedoms of the data subjects.¹⁸  However, where possible, you should contact the patients.