- The GDPR does not apply to people who have died. Each EU country decides its own rules.
- France, Spain and Italy have specific rules. Germany’s top court applied general inheritance law, and the Netherlands had no specific law as of 2021.
- The European Certificate of Succession helps heirs and executors prove their status in another EU country.
- Rules differ a lot, so check the country where the person lived.
There is no single EU law on what happens to someone’s online accounts when they die. This page explains the EU-wide background, then gives short examples from five countries. It is general information, not legal advice.
What EU law says
The General Data Protection Regulation (GDPR) is clear in Recital 27: it “does not apply to the personal data of deceased persons”. Member states may make their own rules.
So the GDPR gives heirs no right to a dead person’s data, which is a common misconception. Any such right comes from national succession law or a national add-on to data-protection law. One exception: data about a dead person can also be personal data of a living person, for example information about a hereditary illness. The GDPR then protects the living person.
Under the EU Succession Regulation (No 650/2012), the whole succession is generally governed by the law of the country where the person was habitually resident when they died. You can instead choose the law of a country whose nationality you hold.
That law decides who inherits, how assets pass and who answers for debts. Digital assets that count as property pass under it like anything else. The Regulation has no rules specific to digital assets.
It applies to deaths on or after 17 August 2015. Denmark and Ireland don’t take part.
The European Certificate of Succession lets heirs, legatees, executors and administrators prove their status and powers in another member state. Using it is optional, and it doesn’t replace national documents. Certified copies are valid for six months.
Country examples
France
French data-protection law (article 85 of the Loi Informatique et Libertés, introduced by the 2016 Loi pour une République numérique) lets anyone set directives about what happens to their personal data after death.
- General directives cover all your data. The CNIL says they can be lodged with a trusted third party such as a notaire.
- Specific directives are lodged with a particular service.
- Directives can’t be created simply by accepting a service’s terms and conditions.
Without directives, heirs can take the steps needed to settle the estate, close accounts and object to further use of the data.
Germany
The Federal Court of Justice (BGH) ruled on 12 July 2018 (III ZR 183/17) that a social network user contract passes to the heirs like any other contract. The parents of a 15-year-old who had died were entitled to access the account and its content. The court compared the account to diaries and letters, which pass to heirs, and held that telecoms secrecy did not stand in the way, because the heirs step into the deceased’s position. Nor did data protection law, which protects only living people.
At the time there was no specific German statute on the digital estate, and a 2019 Bundestag motion noted that a promised law had not arrived. Microsoft, for example, runs a separate German process for heirs who can show an Erbschein (certificate of inheritance).
Spain
Spain’s data-protection law, the LOPDGDD (Ley Orgánica 3/2018), deals with this in two places.
- Article 3 lets relatives, people linked to the deceased by a de facto relationship, and heirs ask a company for access to, correction of or erasure of the deceased’s data. The deceased (or a law) can forbid this, but a ban doesn’t affect heirs’ access to data about the deceased’s property.
- Article 96, the “right to a digital testament”, is described by Spanish legal commentators as letting family and heirs access content held by online service providers and give them instructions, unless the deceased expressly forbade it. It reportedly also lets an executor or a person the deceased chose act, and decide whether social media profiles are kept or deleted. Check the official text before relying on the detail.
Catalonia regulated “voluntats digitals” (digital wishes) earlier, in its own civil code.
Italy
Italy’s privacy code (article 2-terdecies) lets data rights about a dead person be exercised by someone with their own interest, someone acting for the deceased as their agent, or someone with family reasons worth protecting. You can forbid this for online services in a written declaration given to the company. The ban must be clear and specific, can be changed at any time, and can’t override other people’s property rights arising from the death. In 2023 Italy’s data protection authority, the Garante, applied this rule to heirs seeking life-insurance beneficiary details.
Netherlands
As of 2021, the Netherlands had no specific law. That year the responsible minister told parliament that legislation was not appropriate at that point and that action at European level was preferable. The Dutch data protection authority confirms that the data of people who have died isn’t covered unless it also concerns someone living.
What it means if you are planning ahead
- Check the rules where you live. Your habitual residence will usually decide which law applies.
- Set up the providers’ own tools. Google Inactive Account Manager and Apple Legacy Contact let you choose in advance who gets your data. See our guides to Google and Apple.
- Take up any national option. In France, you can set directives. In Italy, a ban on access must be a written declaration given to the service.
- Leave clear instructions. A letter of instruction helps whoever deals with your estate, whatever the country.
What it means for executors and family
Start with the law of the country where the person lived and the documents its courts or notaries issue. Large providers often have their own requirements. Microsoft, for example, wants European court orders served on Microsoft Ireland, and Google asks for a certified, notarised English translation of documents in other languages. If you need to act in another EU country, ask whether a European Certificate of Succession would help.
Documents usually needed
Expect a death certificate and proof of your role as heir or executor under national law, plus translations where a provider asks for them. Our page on the documents you need after a death explains these in more detail.
Rules differ widely between countries, so a local lawyer or notary can confirm what applies to you.