When a User Dies, Who Gets the Password?

**Dr. Ishan Atrey

The Estate Nobody Talks About

When a person dies, the law generally provides a clear framework for transferring the deceased’s assets. Immovable properties, such as houses, will be transferred to the legal heirs; bank accounts can be claimed through a succession certificate or a nomination by the heirs; investments can be passed to a beneficiary. Indian Succession Law has developed significantly since its inception many decades ago to accommodate the distribution of both tangible (land and property) and intangible (financial) assets of an individual’s estate. However, modern living is taking place online, and there is a growing component of a person’s estate that continues to fall outside of the existing regulatory frameworks.

For example, people have had years of personal and professional communication via e-mail in their accounts. Family photographs, important documents, etc., are preserved in cloud storage services. Social media profiles are becoming the digital record of our lives. More than ever before, many people are operating online businesses, earning money via digital platforms, maintaining crypto currency holdings, etc. and storing invaluable information on encrypted password-protected devices. The issue begins once we die and leave behind these digital assets. The law may recognize who should receive them as “legal” heirs but it doesn’t automatically mean they will have the means to obtain them. For instance, if a family knows that a deceased relative owns some form of crypto currency, they will likely not be able to recover it unless they know the “private key.” If a spouse inherits an online business but cannot access the e-mail account that was used to manage that business, then that spouse will not be able to continue running it. Similarly, children may want family photographs stored in a cloud service where nobody else has access to those photos after the original account holder passes away.

It is no longer about whether digital inheritance exists; it is now about how we prepare ourselves and the Indian statute to address an estate form that increasingly exists beyond the reach of traditional succession rules.

Why India’s Succession Laws Are Struggling in the Digital Age

The main issue with the 100 years old Succession Act is that the laws of inheritance were created in an age when it made sense to consider property as something that can be touched and seen and therefore easily pass along to the heirs, even if the property being passed down was money or some other type of non-tangible item, it typically would have been held through a bank or another institution that had a way to confirm who owned it, and how to send it to its new owner.

Digital property does not fit into either category. Some digital properties clearly have monetary value, such as cryptocurrency, monetised social media accounts, an online-only business, digital wallets, and intellectual property stored online. But others clearly have much more than monetary value, such as your email archive, pictures you’ve uploaded to cloud storage, your journal written digitally, and your social media accounts. still yet, many types of digital property will have both types of value.

The question here is not just about deciding whether a person can inherit certain types of digital property; the question is about whether the people inheriting the property will actually have some level of control over it. In many cases, there is a significant difference between owning something legally and having practical access to it. A person’s legal heirs may inherit the right to own the digital property; however, unless they know the login credentials (such as passwords) needed to access it, they may never actually use it.

This particular difference in the law becomes especially relevant when discussing the protection of password-protected and/or encrypted digital account information. Unlike a physical safe or lockbox, which has an established process for accessing its contents using keys or combinations, gaining access to digital account information often requires knowledge of specific login credentials that are known to the deceased only.

When this information is unavailable, the digital property inherited by legal heirs may remain inaccessible to them.

The problem also goes beyond economics. Digital accounts increasingly store information that helps define who a person is and what they leave behind when they die. Examples include family photos, letters exchanged between family members and friends, works of art or music created during someone’s lifetime, and documentation regarding social connections made through social media. Although such items carry considerable emotional weight for surviving family members and friends, Indian succession law provides very little guidance for how to treat digital material left behind after death.

Moreover, digital accounts of the users are an important element of their digital identity. Digital identities include social media, blogs, portfolios, art, and other types of creative content, as well as all of the digital communication you may be able to find by searching for someone. This has caused a new problem that our traditional law of succession has never addressed: who should control what happens to a deceased person’s digital identity?

As a result, there exists today an increasing disparity between technology and law. as long as people continue to acquire digital properties throughout their lives, the law continues to provide little direction on how to manage these acquired digital properties when those owners pass away.

When Platform Rules Override Family Rights

The legal uncertainty becomes even more complex because digital assets are rarely governed solely by law. They are also governed by private contractual arrangements established by technology companies.

Unlike traditional property, digital accounts typically exist within ecosystems controlled by platform providers. Access, transferability, and posthumous management are often determined by terms of service drafted by private corporations rather than inheritance laws enacted by legislatures.

Several major technology companies have attempted to address this challenge through internal policies. Google allows users to activate an Inactive Account Manager, enabling designated individuals to access certain account information after prolonged inactivity. Apple provides a Legacy Contact system that allows approved individuals to request access after the user’s death. Meta permits memorialisation of Facebook accounts and offers limited mechanisms for managing a deceased user’s digital presence.

While these efforts are substantial, they represent only platform-based solutions rather than legally recognized inheritance rights. A legal heir’s ability to gain access to the estate will be substantially affected by the company’s internal policies, and the requirements for accessing the account can vary from one provider to another.

Additionally, there is a problem of limiting a legal heir’s ability to use their right to an asset based on the terms of a private contract. This raises the question as to whether the terms of private contracts should override the operation of the laws of succession. In order to obtain access to assets, a legal heir would need to comply with the corporate policy decisions of the platform provider, rather than have those rights determined by the laws of succession.

This is an important question. Can private companies decide what happens to your digital legacy after you pass away?

When inheritance rights conflict with privacy rights, this creates even greater complexity. Moreover, the deceased’s digital account will most likely include private messages, pictures, financial data, and confidential communication. These types of conflicts raise questions about whether the information contained within digital accounts should still remain private and who should be able to access them. These concerns become particularly significant in light of the privacy principles recognised by the Supreme Court in Justice K.S. Puttaswamy v. Union of India.

Private contracts can also provide for some degree of balancing of competing interests among platform providers. However, due to public policy, succession, and privacy concerns, none of these can be resolved through private contracts. Therefore, we have a broken system where the way to access a deceased person’s digital life is more contingent on the company policy of the platform involved.

What Other Jurisdictions Have Already Recognised

Digital Inheritance is a new area of legal concern that is being addressed by some jurisdictions through specific solutions.

Many U.S. states have enacted versions of the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), which is intended to provide a framework for Executors, trustees, and other Fiduciaries to gain limited access to Digital Assets where they are entitled to do so under the will or trust of the Deceased and where there are reasonable safeguards related to Privacy.

Of greater importance than simply allowing access to Digital Assets is that these enactments recognise that Digital Assets are part of modern Estates and that existing Succession Principles must be modified to accommodate them.

Jurisdictions across Europe are grappling with issues related to Posthumous Data Protection and Family Members’ Rights of Access to Digital Estates. Although there are differences among the various European Jurisdictions on how best to address Digital Estates, there is a broad consensus developing that the regulation of Digital Estates is beyond the scope of Private Platform Policies.

These examples from outside India should serve as an example for India. The problem of Digital Estate is no longer an emerging one; it exists today. Other jurisdictions are developing legal frameworks that provide for heirs’ rights to inherit while respecting the privacy interests of those heirs and the technical realities of digital estates. Therefore, India’s position on this matter is anomalous. Although India has enacted many important reforms concerning data protection and digital governance, it has yet to consider what will happen to a person’s digital assets, data, and online presence after their death.

Building a Framework for Digital Inheritance in India

The lack of a complete regulatory framework doesn’t necessarily limit the ability to inherit digital property; instead, it leaves all parties (individuals, families, service providers, and courts) to navigate ambiguity on a case-by-case basis.

Digital assets are becoming a major component of people’s lives, it is essential to address how succession laws can be adapted to reflect this fact. Many individuals now hold significant amounts of financial, social, and personal wealth through their digital properties. Therefore, if the succession law does not include provisions addressing the status of digital property, it will be out of touch with contemporary society.

First, we need to establish digital property as a distinct class worthy of legal consideration. This will create additional certainty for the rights of heirs and estate administrators.

Second, there needs to be mechanisms under Indian law allowing individuals to articulate their desires relative to what happens with digital property upon their passing. Much like a Will allows individuals to dictate how physical property should be distributed upon their passing, future legislation can also allow individuals to define how digital accounts, online content, and individual information should be dealt with post-mortem.

Third, the law has to deal with the balance between inheritance rights and privacy rights. Not every digital property deserves automatic accessibility by heirs. Personal communications, private documents, and sensitive data raise valid concerns that demand careful consideration.

Further, India’s legislative reforms should minimize the reliance on platforms’ self-regulatory policy approaches. While some technology companies have created very useful tools, issues related to succession and inheritance are inherently part of the realm of law not contractual agreements among service providers.

Many people view digital inheritance solely as a challenge of password management and account administration. However, it is fundamentally about how the law views property, identity, memory, and control in an increasingly digital world. Succession law was designed for a world where assets were tangible objects that could be found and transferred. That world is quickly evolving.

In the digital world, inheritance is no longer just about moving physical property. It is increasingly about identifying who has permission to access, manage, protect or destroy the “digital footprints” of a deceased person that continue to exist even after death. The longer that we wait for the law to engage this issue, the greater the gulf is likely to grow between legal inheritance and the realities of digital property.

**Dr. Ishan Atrey has been actively engaged in legal education and research for over seven years. He currently serves as an Assistant Professor at the School of Law, GD Goenka University, Sohna, Gurugram.

**Disclaimer: The views expressed in this blog do not necessarily align with the views of the Vidhi Centre for Legal Policy.