ABSTRACT
Death no longer terminates a person’s digital existence. Social networks profiles, Emails, cloud storage and cryptographic assets outlive the individual, resulting in an ungoverned legal status called “data ghosting.” India’s Digital Personal Data Protection Act, 2023 (DPDP Act) does introduce a preliminary nomination mechanism under Section 14, but it doesn’t create a full-fledged post-mortem privacy and digital succession framework. By contrast, the European Union’s General Data Protection Regulation (GDPR) excludes deceased persons while devolving authority to member nations, and the United States’ Revised Uniform Fiduciary Access to Online Assets Act (RUFADAA) emphasises explicit online instructions, testamentary intent, and service contracts. This article assesses these comparative paradigms, underscores the shortcomings of traditional Indian succession statutes, and advances a customised nomination-centric regulatory framework for the management of digital remains, fiduciary access, and account termination in India.
KEYWORDS: Post-Mortem Privacy, Data Ghosting, Digital Remains, DPDP Act 2023, RUFADAA, Digital Succession, Fiduciary Access.
INTRODUCTION
An Indian citizen’s digital ecosystem comprising cloud albums, chat logs, social media accounts, and financial credentials does not cease to exist upon their death. Instead, these records persist across domestic and international servers, giving rise to data ghosting: the indefinite, unmanaged persistence of digital footprints due to a lack of clear legal authority over account access, preservation, or deletion.
Post-mortem privacy operates as a legal fiction; a deceased individual cannot directly exercise statutory rights, grant active consent, or suffer personal reputational harm. But the testamentary intent, personal dignity and privacy expectations do not cease upon death. The law has to answer the question whether these residual interests bind data controllers, platforms and legal heirs.
In India, families seeking to address a deceased relative’s digital footprint face three distinct legal regimes: the ancient succession laws that govern physical chattels, the data protection laws that are relevant only to living subjects, and the private, foreign platform-based terms of service that operate as de facto laws. We need to fix this underlying governance failure, rather than relying on technical workarounds to address data ghosting.
THE STATUTORY GAP IN INDIA
The DPDP Act, 2023 of India is built around the concept of the Data Principal, which is primarily defined as a “living” person who is able to give or reject consent. Section 14 provides that Data Principal may designate a nominee to take action on their own behalf in the event of their death or incapacity but does not address important issues. It does not explain how a nominee can force deletion of the data, the process for the disclosure of private communications or how to reconcile the conflict of the platform terms, judicial probate orders and familial claims.
Section 14 proposes a model of continuity of autonomy rather than the automatic transfer of privacy rights. As a legal heir can receive a physical photograph album without automatically receiving the right to publish private letters in the scrapbook, a digital nominee should not automatically be granted access to private communications without permission.
The governing laws of India regarding succession, which include the Indian Succession Act, 1925 and the various personal laws for different religions such as the Hindu Succession Act, 1956 etc., have been in existence prior to the advent of digital assets. An executor with a valid probate order has authority over real property or bank deposits, but not over encrypted communication or foreign cloud servers. The general privacy rights principles of property law therefore have not caught up with digital remains.
COMPARATIVE MODELS: EU AND US APPROACHES
The European Model: Member State Flexibility
Recital 27 of the GDPR makes it clear that the GDPR does not apply to the personal data of “deceased individuals”, thus allowing member states to make their own laws. France made use of this flexibility with its Digital Republic Act, which provides the ability of individuals to give binding instructions before death regarding the storage, communication or elimination of their own personal information to a designated trusted party. By contrast, German law considers digital accounts, such as private chat histories, to be a component of the hereditary estate and assigns them to the legal heirs, just as a paper diary and physical letters.
The American Model: Procedural Fiduciary Access
In the US, the main law dealing with digital succession is RUFADAA. It settles conflicts by using a simple three-step order of priority:
- Online tool settings come first. If the person used a feature like Google’s Inactive Account Manager to leave instructions, those instructions win.
- A will or estate document comes next. If there’s no online tool setting, then a valid will, trust, or power of attorney decides what happens.
- The platform’s terms of service come last. If neither of the above exists, the company’s standard rules apply by default.
RUFADAA is only about access it says who is allowed to ask for the account. It doesn’t say how long a dead person’s account can sit around before it must be closed, and it doesn’t set any rules for how long the data itself should be kept.
PLATFORM GOVERNANCE VS. TESTAMENTARY PRACTICE
Private digital platforms have taken over the role of regulators for digital legacy because there is no single statutory framework in place. There are features such as Apple’s Legacy Contact, and Google’s Inactive Account Manager, which offer functional access mechanism. Yet, they seem to work largely without the supervision of Indian courts.
This often leads to conflicts between general testamentary documents and platform settings. A typical will in India will not usually include digital accounts when granting an executor power over “all assets, moveable and immoveable.” On the other hand, it is possible for a platform “legacy” setting that was established years ago to supersede a later estate plan. The platform terms of service are the primary standard of governance, leaving families in confusion, often bargaining directly with corporate help desks, with no standard legal remedies or uniform timeframes.
TOWARD A TAILORED INDIAN DIGITAL-REMAINS FRAMEWORK
India should not copy foreign models in their pure form, but can draw on its existing banking and insurance nomination systems as provided by the DPDP Act. There should be five fundamental elements in a statutory framework for digital remains:
- Definition of Digital Remains: Codify a formal statutory definition distinguishing financial and property-like digital assets (e.g., domain names, crypto-wallets, monetized channels) from purely private communications (e.g., personal messaging logs). Personal data belonging to a third party, embedded in a deceased person’s files, should be kept safe as well.
- Notice and Verification Protocol: Make it mandatory for platforms running in India to have a uniform verification process. If a death certificate is presented with proof of nomination or legal executorship, the account state will be preserved temporarily, and the demands for deletion/transfer/memorialization will be fulfilled.
- Access restricted to a specific purpose: When it is really necessary to settle the estate, resolve taxes or pay off debts a nominee or legal representative should be given access to account records. But private chats or personal conversations should be off limits unless the person specifically gave permission before dying, or a court specifically rules otherwise.
- A clear legal basis to process a deceased person’s data: The law should specify precisely when a person is permitted to access a deceased person’s data. And even then, only the data that is essential for that particular purpose must be used, and it shouldn’t be utilized for any purpose beyond that.
- Integration with Digital Legacy Planning: Promote digital inventory planning in Indian estate planning, where people can designate a legacy contact and note explicit preferences about what to delete along with their regular wills.
CONCLUSION
While digital legacy is a normal part of daily life, it can lead to legal issues for families, platforms and the after-life respect and dignity of the deceased. While Section 14 of the DPDP Act, 2023 provides a starting point, it is clear that the legislation needs to be expanded to create a new digital succession framework.
The law can take on the challenge of data ghosting by drawing on the European user instructions, the American structured fiduciary hierarchy, and the existing nominee system in India. It is also important to recognize that legal structures should not provide data an automatic immortality, but rather make sure that digital life ends, continues, or passes on in accordance with rules that could be anticipated by the person in their lifetime.
“PRIME LEGAL is a National Award-winning law firm with over two decades of experience across diverse legal sectors. We are dedicated to setting the standard for legal excellence in civil, criminal, and family law.”
WRITTEN BY: HARSHMEET KAUR SUDAN
