The Afterlife of Data: Who Controls Our Digital Legacy?

For technology leaders, the key issue is not whether digital legacy matters, but who owns the decision rights while the person is alive. This is a governance problem that cuts across identity, legal, HR, security and customer experience. If organisations do not define who can act on death, incapacity or account dormancy, they leave a vacuum that will be filled by platform defaults, not enterprise policy.

That makes the operating model the real control point. CIOs and governance leads should ask whether policies for posthumous data, account memorialisation, deletion, retention and nominee access are embedded in records management, privacy notices and support workflows. The practical trade-off is between simplicity and nuance: broad rules are easier to operate, but exceptions are inevitable for regulated data, high-value IP, clinical records or employee estates.

Vendor dependence is another management risk. Much of the relevant data and decision logic sits with external platforms, cloud providers and identity services. That means post-death access, deletion and transfer rights may be constrained by contracts rather than enterprise intent. Leaders should review whether procurement terms, data processing agreements and backup retention policies actually align with the organisationโ€™s legal and ethical stance.

The next questions are operational and measurable:

  • Who approves requests involving deceased or incapacitated users?
  • Which systems can enforce deletion, retention freeze or nominee access end to end?
  • What evidence is required to protect against fraud, misuse or unauthorised disclosure?
  • How will the organisation test these controls before a real case creates reputational risk?

Handled well, digital legacy policy becomes part of data governance maturity rather than a niche legal issue. Handled poorly, it becomes an avoidable source of customer harm, compliance exposure and fragmented accountability.


In an era where our digital footprints often outlast our physical ones, the question of what happens to our data after we die has become a hot topic. This debate is explored in-depth in a new book titled โ€œThe Afterlife of Data,โ€ which delves into the ramifications of big tech controlling our data posthumously. Now, following estimations that Facebook will have the profiles of almost 5 billion deceased users by the end of the century, individuals need to also consider the data they are leaving behind. Otherwise, it could be exploited, monetised, and even used for AI enabled โ€˜interactionsโ€™ by these sites.

The Legacy of Our Data

Throughout history, we have used data from deceased individuals to further our understanding and to improve and inform our own lives. Florence Nightingale’s pioneering work in nursing, for instance, continues to inform medical practices today. But how does this historical usage differ from social media giants like Facebook leveraging our data after death? The main difference is who it benefits. Nightingaleโ€™s research continues to inform and be relevant to medicine to this day, the data Meta holds could have a similar benefit if it wasnโ€™t held and leveraged for profit. If there is no benefit to the common good, it begs the question whether a business should be able to exploit it. Related:What Happens to Our Data When We Die? A morbid example would be creating chatbots of deceased loved ones. Meta or Google could likely produce custom chatbots with the wealth of data available. While this might bring comfort to some, regardless of how you feel about it, there is currently no legal mechanism to prevent an AI developer from creating a digital golem.

The Current Debate: Where Do We Draw the Line

Weโ€™ve always used data from the deceased in some shape or form, but with today’s powerful technology, the stakes are much higher. The winner takes all dynamics that govern internet traffic has condensed the main curators of data into a handful of companies. These firms are already using this information to conduct massive studies and population analyses. While the internal studies that Meta and Google conduct on their data are not available to the public, the ad-selling platforms that underpin their business models are already demonstrating โ€˜spookyโ€™ abilities. Recent examples include predicting pregnancies, or breakups based on online behavior. Data becomes more powerful the more is available, even if it seems innocuous, in such large volumes it can enable powerful predictions. At present these companies have a lot of power and almost no responsibility. Related:Salary Report: IT in Choppy Economic Seas and Roaring Winds of Change

The Impact of Embedded Technology

Wearables, injectables, and implantables are all new frontiers for technology that are becoming increasingly mainstream. While Elon Muskโ€™s Neuralink is the most famous example of an implanted technical interface, Paradromics, Synchron, and Blackrock Neurotech are also currently developing human/technical interfaces that are embedded directly into the user. The ethical considerations of creating a hardline into someoneโ€™s skull are enough to wrestle with, what happens if these startups go bust? Normally data is one of the resources sold off as part of bankruptcy proceedings. Potential buyers of such a firm would have the responsibility to protect and continue service to buyers that may rely on the technology to function, as well as a wealth of data. Data brokers can already use our behavior to infer our thoughts, the ability to capture and sell them directly could lead to egregious privacy violations.

Navigating Ethical and Moral Standpoints

The debate over the afterlife of our data is multifaceted and deeply intertwined with our own personal beliefs and values. Some might believe that our data should be treated with the same respect and privacy as our physical remains, while others see it as a valuable resource for advancing knowledge and technology. However, the greatest impact is often on the living who are left to manage the digital afterlife of their loved ones.

Governments Playing Catch up

While the digital revolution has been less than a lifetime, some industries and legislatures are beginning to consider what happens to data postmortem. In the UK the NHS states that while Original Postrinciples-deceased.html#:~:text=Consent%20and%20Participant%20Information%20Guidance&text=In%20legal%20terms%2C%20the%20General,death%20does%20extend%20beyond%20death." target="_blank" rel="noopener" shape="rect">GDPR expires after death, issues of confidence and private medical information are still protected, and responsibility for this data can be transferred to a nominated party. There are steps in the right direction but overall, there is no connected approach to managing this reality. Considering that governments are beginning to understand the value of data, whether that is genealogical, personal or financial, a coherent strategy for data will emerge. It is more likely in Europe, which tends to be faster to legislate than the US or UK. Currently, solicitors advise that passwords and accounts are listed down to be made available to next of kin. Understandably, some want the same level of privacy in death as in life, but value has to be balanced with respect for privacy. This data has the potential to identify trends and predict outcomes that could have immense benefits for people living today. However, the current grey area benefits companies and few others so if nothing else this must be addressed.
https://www.informationweek.com/data-management/the-afterlife-of-data-who-controls-our-digital-legacy-

Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.