GDPR and digital legacy: does EU data protection law cover you after you die?
2 August 2026 · Inherit Vault
GDPR protects "personal data" belonging to a "data subject," and a data subject, under the regulation's own definition, is a living natural person. The moment someone dies, GDPR's own protections, by default, stop applying to them at all.
What that actually means
A deceased person's data isn't automatically protected from disclosure or use under EU law the way a living person's is, GDPR simply has nothing to say about it either way, which sounds like it should make things simpler for grieving families trying to access accounts. In practice it doesn't, because platforms' own terms of service, not GDPR, still govern what they'll release, and most remain cautious by default.
Where member states have filled the gap
Several EU countries have passed their own national laws extending some data protection, or explicit digital-legacy rights, to deceased individuals, France's Loi pour une République numérique, for instance, gives people the right to leave instructions for what should happen to their data after death, binding on platforms operating there. Provisions like this vary significantly by country, some have detailed rules, others have none at all.
The living relative's own rights
Where a family member wants a deceased person's data because it also happens to be their own, joint photos, shared correspondence, GDPR's protections for the living relative's own data can sometimes be invoked, a genuinely different legal route from trying to access the deceased's account directly.
What this means for planning ahead
Because the legal baseline is inconsistent, and because relying on it means relying on national law that may not exist or may not have been tested, the platforms' own built-in tools, legacy contacts, inactive account managers, remain the most reliable route regardless of which EU country is involved. A legal right to ask is not the same as a fast or certain way to get an answer.
None of this is simplified by better legal knowledge alone, it's simplified by a list: which accounts exist, whether a legacy contact is set on each, and what should happen to them. That list works the same way whether the law behind it is GDPR, a national digital-legacy statute, or nothing at all.
Sorting this out for someone else? Make sure your family never has to.
Most of the time goes on finding out what the person had and who to call. Inherit Vault keeps that list for you: your accounts, pensions and policies, and where your will is kept. Only you can read it. Your executor gets it when it is needed.
Read more
- Digital legacy planning: leave your family a map, not your passwords
- Your crypto is now legally property: the Digital Assets Act 2025 (UK)
- Should you name a digital executor for your online accounts? (UK)
- Are digital wills legally valid in the UK yet?
- RUFADAA and digital assets: what happens to your online accounts when you die (US)