The ‘right to nominate’ under DPDP: A statutory right with no statutory procedure

As more of a person’s life moves online, a need has emerged to address what happens when an individual dies or is unable to access their digital data due to incapacity. India’s new data protection law attempts to address this through the nomination right but leaves gaps that a data fiduciary must fill to comply with the legislation's objectives.

Section 14(1) of the Digital Personal Data Protection Act, 2023 (“DP Act”) allows an individual, the data principal, to nominate any other person who may, on the data principal’s death or incapacity, exercise that individual’s statutory rights under the DP Act and the Digital Personal Data Protection Rules, 2025 (“DP Rules”). The Act grants the nominee broad authority to exercise powers as if stepping into the shoes of the data principal.

The gap the provision attempts to fill is genuine, but the machinery to operate it is thin. Further, because the law on whether digital personal data can be considered “property” capable of succession is still undeveloped, it can lead to conflict when an heir stakes a competing claim. Section 38, which provides that the DP Act prevails in the event of conflict with other laws, does not address the question related to succession or access rights of the heirs. Thus, this creates considerable ambiguity for all stakeholders.

As the law stands, without legislative guidance, conflicts may arise between nominees and an individual's legal heirs. The Supreme Court confirmed in its December 2023 judgment in Shakti Yezdani v. Jayanand Jayant Salgaonkar that nomination under Indian law creates neither a statutory testament nor a third line of succession. Accordingly, where a nominee’s decision conflicts with the wishes of the legal heir, the courts will need to reconcile the data principal’s intentions, expressed through their nominee, with the legal heirs’ interests. A situation could arise where a nominee wishes to delete the data, but the heirs require retention for probate, tax, or litigation.

Rule 14(4) of the DP Rules permits the data principal to nominate “one or more individuals” but says nothing about whether multiple nominees act jointly or severally, how conflicting instructions should be resolved, or what happens if a nominee dies before the data principal. It also does not address whether an heir who has not been nominated can exercise any rights over the deceased’s data.

Further, the nomination right does not allow the data principal to specify the scope of access their nominees should have in case such an individual dies or is incapacitated. Section 40(2)(p) of the DP Act empowers the Government to prescribe the manner of nomination, but the DP Rules largely defer to each data fiduciary’s own terms of service.

Another issue that arises is that the current framework does not prescribe any statutory standard for verifying a nominee at activation. Section 14(2) defines incapacity as an inability to exercise the rights due to “unsoundness of mind or infirmity of body." The underlying conditions that trigger the nomination are broad and lack a certifying test, unlike parallel provisions under the Mental Healthcare Act, 2017 [Section 4] and the Rights of Persons with Disabilities Act, 2016 [Section 14].

By comparison, Sections 45ZA and 45ZG of the Banking Regulation Act, 1949, provide a more developed framework for nomination, capping deposit nominees at four, requiring percentage allocation, addressing lapsed nominations, and assigning priority among multiple nominees. In addition, a line of successive judgments has clarified that a nominee to shares or bank deposits does not acquire beneficial ownership and holds what is received for the legal heirs.

Apple has a digital legacy program. When a user nominates a legacy contact, Apple generates an access key which the user shares with that person. Following the user’s death, the legacy contact must provide the access key and a death certificate to obtain access. Apple permits users to nominate more than one legacy contact, and each contact can make decisions about the account, including requesting its permanent deletion.

Google’s Inactive Account Manager takes a different approach. Instead of requiring confirmation of death, it allows the user to specify a period of inactivity after which the selected trusted contacts may be notified. A user can designate up to ten contacts and decide which categories of information each contact may receive. Google also verifies the contact using their phone numbers.

Meta takes a more limited approach. Its legacy contact is restricted to limited profile management and does not allow access to private messages. X permits an account to be deactivated upon production of a death certificate but does not provide a ‘nominated person’ with access to the account’s data. Microsoft generally requires a court order or subpoena for access to the contents of an account.

These policies give effect to the user’s wishes, but do not map neatly onto Section 14. In some respects, the statutory nominee has less than a platform legacy contact, since Section 14 confers no right to the contents of an account; in others it has more, including a statutory right to seek erasure and to raise grievances. All these major companies will need to align their Indian services with the nomination right under the DP Act.

An instructive Indian model which could be adopted is SEBI’s DigiLocker circular dated March 19, 2025. DigiLocker uses the register of deaths maintained by the Registrar General and Census Commissioner, supplemented by demise information held by KYC Registration Agencies, to confirm death. The nominee is then automatically notified by SMS and email and accesses the deceased user’s digital information through the nominee’s own authenticated DigiLocker account.

Before the DP Act takes full effect on May 13, 2027, the primary task for all data fiduciaries is to publish a dedicated nomination pathway. The nomination mechanism should be placed in the consent management interface, not buried in the terms of service. The data principals should also be clearly told the implications of appointing a nominee and the extent to which the nominee will be able to access and control their digital data post-death or incapacity.

A workable solution to identify the nominee could be a nomination reference token generated at the time of nomination and given to the data principal, so activation rests on something the nominee holds. Such measures can help determine nominee activation and ensure it is not contested later.

Where the data principal names more than one nominee, the data fiduciary should require the data principal to specify priority or scope at the point of capture and should disclose rules for conflicting instructions. A sensible default could be that each nominee may act alone for access and correction, with a priority requirement or unanimity for irreversible actions such as erasure.

The evidence required on activation ought to be tiered rather than uniform. Death presents the simpler case, as a death certificate, together with an identity match against the nomination record, should suffice. For incapacity, the data fiduciary should require medical certification, guardianship documentation, or a court order as acceptable alternatives.

Further, the data fiduciaries will need to be vigilant before granting the nominees access to the data principal’s data. Proper identity verification and activation would be necessary. Granting access to someone who is not the nominee is an unauthorised disclosure of personal data and therefore a personal data breach, attracting exposure of up to INR 250 crores for failure to take reasonable security safeguards [Section 33(1) r/w items 1 and 2 of the Schedule, Digital Personal Data Protection Act, 2023].

The DP Act’s right to nominate is a genuine addition to data protection law, but it still leaves several gaps. It requires work on major fronts.

The government should not leave the core mechanics to terms of service but should mandate baseline standards. At a minimum, it should require every data fiduciary to provide a clear nomination pathway, allow modification and revocation, disclose whether multiple nominees may act jointly or severally, and state the evidence required to activate upon death or incapacity.

Data fiduciaries should not wait for that guidance but should build the safeguards described above now.

Data principals should not treat nomination as a forgotten click but as part of ordinary estate planning. They should choose a nominee with the same care as a bank nominee or attorney, keep it current, and preferably align it with wills and legacy settings in existing applications.