Have You Planned Your Digital Afterlife Under the DPDP Act?

In the physical world, we are familiar with the idea of a “nominee.” For example, in bank accounts, insurance policies, or property ownership, we usually name someone who can take charge if something happens to us.

But for many years, our digital lives, such as photos, emails, financial information, and social media accounts, did not have similar clarity. When a person died, their data often became inaccessible or was at risk of misuse because there was no clear legal process for transferring control to family members.

With the full implementation of India’s Digital Personal Data Protection (DPDP) Act in 2026, this gap has been addressed through a new concept: the “Right to Nominate.”

What is right to nominate?

Section 14(1), DPDP Act, 2023. The “Right to Nominate” means that a person (called the Data Principal) can choose someone they trust (the nominee) to act on their behalf if they:

• Pass away, or
• Become unable to make decisions (for example, due to a coma or serious illness)

In simple terms, it is like choosing a nominee for your bank account, but for your digital data.

This nominee can then deal with companies and platforms that hold your personal data and take actions on your behalf, such as managing or requesting access to that data.

Why is this Important?

Earlier, there was no clear law in India explaining what should happen to a person’s digital data after their death or if they became unable to manage it. This led to several problems:

• Families could not access important information like emails or financial details.
• Social media accounts stayed active even after the person passed away.
• There was a higher risk of identity theft or misuse of data.
• Different companies followed different rules for giving access.

The “Right to Nominate” helps solve these problems by creating a clear legal link between the individual and a trusted person who can act on their behalf.

What Can a Nominee Do?

Once a nominee is properly appointed, they can use the same rights that the individual had under the Digital Personal Data Protection Act, 2023. These include:

1. Access Personal Data

The nominee can ask companies:

• What personal data do they have
• Why are they using it?
• Who they have shared it with

2. Correct or Update Data

If any information is wrong or outdated, the nominee can ask for it to be corrected.

3. Request Deletion

The nominee can ask companies to delete personal data, especially if it is no longer needed.

4. Withdraw Consent

If the individual had permitted the use of their data, the nominee can take back that permission and stop further use of the data.

Example 1: Social Media Account Management

Rahul regularly uses many social media platforms and chooses his sister as his nominee.

After Rahul passes away, his sister contacts these platforms and:

• Asks what personal data they have about him
• Requests the deletion of certain private messages and personal information
• Requests that the account be either memorialised or permanently removed

Without being nominated, she may have found it difficult to prove that she has the authority to make these requests. With the DPDP framework, her role is clearly recognised under the law.

Example 2: Managing Financial and Email Data

Sunita becomes seriously ill and is unable to make decisions. Earlier, she had nominated her husband under the Digital Personal Data Protection Act, 2023.

Her husband can now:

• Access important emails related to bills and investments
• Update or correct outdated contact details
• Stop companies from sending marketing messages by withdrawing consent.
• Ask for the deletion of personal data that is no longer needed or is sensitive.

This helps ensure that her important information is properly managed and reduces the risk of misuse.

How is This Different from a Will?

It is important to understand that the “Right to Nominate” under the Digital Personal Data Protection Act, 2023, is not the same as a will. Both serve different purposes.

Implementation Considerations for Organisations

For companies (called Data Fiduciaries), this provision under the Digital Personal Data Protection Act, 2023, creates new responsibilities.

They need to:

• Provide a nomination option: Allow users to choose and register a nominee.
• Verify requests: Make sure that the person claiming to be a nominee is genuine.
• Handle requests properly: Set up processes to deal with access, correction, or deletion requests from nominees.
• Maintain records: Keep track of all actions taken by nominees for accountability.

To do this effectively, companies will need to update:

• Their privacy policies
• User account settings (to include nomination features)
• Internal data management processes

These steps will help ensure compliance and proper handling of nominee-related requests.

Practical Takeaways for Individuals

To make the most of the Right to Nominate under the Digital Personal Data Protection Act, 2023, the following points need to be taken into consideration.

• Choose someone you trust
  Pick a person who is responsible and understands your digital life.
• Inform your nominee
  Make sure they know about their role and what they may need to do.
• Keep it updated
  Review your nomination from time to time and update it if needed.
• Plan along with a will.
  Use this alongside a will or estate plan for complete coverage of your data and assets.

Conclusion

The “Right to Nominate” under the Digital Personal Data Protection Act, 2023, clearly outlines how personal data should be managed when a person passes away or cannot make decisions, guiding both individuals and organisations.

It reflects an important idea: our digital lives matter just as much as our physical ones. By allowing individuals to appoint someone they trust, the law ensures that personal data can still be managed, protected, and handled responsibly when they are no longer able to do so themselves.

For individuals, this is a way to plan and stay in control of their digital presence. For organisations, it means building more responsible and transparent systems for managing personal data.

Taking these proactive steps protects not only your personal information but also that of those you care about, helping ensure your digital legacy is managed in line with your wishes.