GDPR and digital legacy: does EU data protection law cover you after you die?
2 August 2026 · Inherit Vault
GDPR protects "personal data" belonging to a "data subject," and a data subject, under the regulation's own definition, is a living natural person. The moment someone dies, GDPR's own protections, by default, stop applying to them at all.
What that actually means
A deceased person's data isn't automatically protected from disclosure or use under EU law the way a living person's is, GDPR simply has nothing to say about it either way, which sounds like it should make things simpler for grieving families trying to access accounts. In practice it doesn't, because platforms' own terms of service, not GDPR, still govern what they'll release, and most remain cautious by default.
Where member states have filled the gap
Several EU countries have passed their own national laws extending some data protection, or explicit digital-legacy rights, to deceased individuals, France's Loi pour une République numérique, for instance, gives people the right to leave instructions for what should happen to their data after death, binding on platforms operating there. Provisions like this vary significantly by country, some have detailed rules, others have none at all.
The living relative's own rights
Where a family member wants a deceased person's data because it also happens to be their own, joint photos, shared correspondence, GDPR's protections for the living relative's own data can sometimes be invoked, a genuinely different legal route from trying to access the deceased's account directly.
What this means for planning ahead
Because the legal baseline is inconsistent, and because relying on it means relying on national law that may not exist or may not have been tested, the platforms' own built-in tools, legacy contacts, inactive account managers, remain the most reliable route regardless of which EU country is involved. A legal right to ask is not the same as a fast or certain way to get an answer.
None of this is simplified by better legal knowledge alone, it's simplified by a list: which accounts exist, whether a legacy contact is set on each, and what should happen to them. That list works the same way whether the law behind it is GDPR, a national digital-legacy statute, or nothing at all.
Leave your family a map, not a mystery.
Inherit Vault is a digital inheritance vault: every account, policy, and instruction your family will need, encrypted so only you can read it, released to your executor when it genuinely matters.
More articles
- Retiring or owning property in the EU: what happens to your estate if you die abroad
- Inheritance tax across Europe: which countries tax it, and how much
- Forced heirship in Europe: why you can't always leave everything to whoever you want
- The EU Succession Regulation: how to choose which country's inheritance law applies to your estate
- Unclaimed property in the US: how to find money you didn't know you had