Skip to main content

Q3 - Can heirs or nominees access the data of a deceased person?

Answer

Yes — under the Digital Personal Data Protection Act, 2023 (DPDPA), a Data Principal (the individual whose data is collected) can nominate another person to exercise their data rights in the event of their death or incapacity.

This ensures that after the Data Principal’s death, the nominee (or legal heir, if no nominee exists) can continue to manage, access, or request deletion of the deceased’s personal data under the same legal rights.

Section 14(1) —
A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder.

Section 14(2) —
“Incapacity” means inability to exercise rights due to unsoundness of mind or infirmity of body.

This means the nominee or heir steps into the shoes of the deceased and can perform any lawful act — such as requesting correction, erasure, or access to personal data — just as the Data Principal could during their lifetime.

2. Scope of the Nominee’s Rights​

The nominee or heir can:

  • Request access to the deceased person’s personal data (Section 11).
  • Request correction or erasure of the deceased’s personal data (Section 12).
  • File grievances or complaints with the Data Fiduciary or Data Protection Board (Section 13, 27).

However, these rights apply only to the extent permitted by law — for instance, data necessary for ongoing legal or financial obligations cannot be erased.

3. When No Nominee Is Registered​

If the deceased individual did not nominate anyone:

  • Access or decisions regarding their personal data may fall to legal heirs or representatives, subject to succession laws and proof of authority.
  • Data Fiduciaries may require documentation (e.g., death certificate, proof of kinship) before granting access.
Example

A user of an online payment platform nominates her spouse under the DPDPA framework. After her death, the spouse requests closure of her account and deletion of transaction history. The platform verifies the nomination and processes the erasure under Section 14, while retaining minimal data required for statutory financial record-keeping.

4. Compliance Implications for Companies​

Organizations must:

  • Provide a mechanism for Data Principals to nominate someone at the time of registration or consent.
  • Verify nominee identity securely before granting access to personal data.
  • Maintain clear policies for data access and erasure of deceased users.

Referenced Provision:

  • Section 14(1)–(2) – Nomination rights and scope for heirs or nominees after death or incapacity of the Data Principal.