Deceased persons in customer files: separating GDPR rules from estate access

Under Recital 27, the General Data Protection Regulation generally does not apply to personal data about deceased persons. That exclusion does not by itself answer whether a customer file may be opened, sent to a relative or used to delete a digital account. The data about the deceased must be separated from information about living people and from other statutory or contractual duties.

This article classifies the core data protection question after a death. It focuses on customer files, digital account information, estate access, confidentiality and mixed data sets. Who is an heir and how an estate is administered are separate legal questions that depend on the records and circumstances of the case.

Recital 27 GDPR expressly states that the Regulation does not apply to personal data about deceased persons. The rule reflects the GDPR focus on protecting living natural persons when their personal data are processed. Article 4(1) defines personal data as information relating to an identified or identifiable natural person.

The exclusion has a limited meaning. The GDPR is generally not the direct data-subject basis for data about the deceased. Recital 27 also allows Member States to provide their own rules for processing such data. A death can therefore trigger further legal questions outside the GDPR.

In practice, the statement that the GDPR no longer applies is not enough. Before disclosure, further use or erasure, identify the information, the requester, the purpose and the proposed action. Then check whether national, contractual, professional or other confidentiality rules apply.

A customer file can continue to contain extensive data about living people after a death. These may include heirs, relatives, authorised representatives, employees, business partners or people mentioned in messages and attachments. Article 4(1) GDPR still applies where a person is directly or indirectly identifiable.

Information about the deceased can also say something about a living person. A message may describe family relationships, an account request may identify the requester and a power of attorney may contain personal data about the authorised person. The death does not remove that separate personal-data link.

An access request therefore requires the file to be divided into data categories. Identify which information concerns the deceased, which concerns living people and whether partial disclosure or redaction is needed. The article on access requests under Article 15 GDPR explains identity, search scope and the data copy for living data subjects.

Customer files are rarely limited to one person. Contracts, emails, call notes, invoices, identity documents and technical logs can connect several people and purposes. For data about living people, Article 5 GDPR requires purpose limitation, data minimisation and security appropriate to the risk, among other principles.

The death is therefore a reason to review the file, not a complete answer. It is neither a legal basis for disclosure nor a reason to erase every item immediately. For each data category, assess whether it is still needed for a purpose, who should access it and which legal basis under Article 6 GDPR supports processing data about living people.

Take particular care with health data, private messages, access details and third-party information. A technical copy of the entire file may contain more information than the requested purpose requires. The article on anonymisation and pseudonymisation helps assess whether information is genuinely free of a personal-data link or can still be connected through additional knowledge.

An access request may arise from an estate matter, for example when a person asks for documents, messages or digital account information belonging to the deceased. The first data protection question is whether the requested information concerns only the deceased or also contains data about living people and confidential information about others.

Access is not established merely by describing the requester as a relative or heir. Evidence, powers of attorney, contractual terms, professional secrecy, statutory confidentiality and other national rules may matter. This article does not decide heirship or administer an estate. It identifies the data protection questions that should be organised before disclosure.

Digital accounts add a technical and contractual layer. An account, message archive, device access and stored files may be governed by different rules. Identify the precise action requested: information, a copy, transfer, restriction, deletion or access to a service. Each action requires its own basis and a limit to the necessary scope.

The exclusion of deceased-person data from the GDPR does not mean that a customer file must be deleted without further review. Contractual duties, professional secrecy, statutory documentation or retention rules and the need to preserve evidence can affect the handling of records. Which duty applies depends on the contents and the relevant business area.

The reverse is also true. A general retention habit does not justify unrestricted use of the entire file. Define which records are retained for which purpose, who may access them and when erasure or restriction is reviewed again. For living people, the principles in Article 5 GDPR and an appropriate legal basis under Article 6 remain relevant.

Confidentiality must also be assessed specifically. A customer file may contain information relating to the deceased, living relatives, business partners or the organisation. Record which information is to be released, which parts are withheld or redacted and which rule or balancing exercise supports the decision.

Start with a complete overview. Record the customer file, digital accounts, messages, attachments, backups, recipients and requested access. Mark the deceased, every identifiable living person and information linked to a legal person or a purely technical process.

Then classify the requested action and purpose. Is the request for a copy, one item, restriction, erasure or ongoing account administration? Record who made the request and which documents that person provides. The identity and authority review should not be limited to whether the request sounds plausible.

Finally, document the decision for each data category. Record legal basis, recipient, scope, redactions, confidentiality, retention and the date for the next review. The erasure concept for customer and lead data complements the general organisation of purposes, retention and deletion procedures. After a death, that framework must be adapted to the file and the additional rules that apply.

We review the file contents, data about living people, requested access, supporting records and contractual, professional and statutory confidentiality or retention duties. For an initial assessment, please provide the customer file, the request, the action sought, the intended recipients and any powers of attorney or other evidence. Contact us when a death requires the distinction between data protection, confidentiality and estate access. Subscribe to legal updates.