Managing the digital footprint of a deceased person: deletion, memorialisation and access for relatives and heirs

Social media profiles that remain active, email accounts nobody can open, photographs stored in the cloud, subscriptions that keep being charged: a person's digital footprint does not vanish when they die. Spanish law gives relatives and heirs a channel to manage it, but three concepts that are often confused should be kept apart: the erasure of data, the conversion of profiles into memorialised accounts, and access to the deceased person's content. None of them amounts to a complete removal of someone's presence from the internet.

Header image generated with AI.

The legal framework: rights do not die with the data subject, but they change hands

The General Data Protection Regulation applies only to living natural persons (recital 27 GDPR), leaving the regulation of deceased persons' data to each Member State. In Spain, the answer lies in Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights. Its article 3 provides that persons linked to the deceased by family or de facto ties, as well as their heirs, may address the data controller or processor to request access to the deceased's personal data and, where appropriate, its rectification or erasure.

The rule carries a significant exception: where the deceased expressly prohibited access, or a law prevents it, relatives and heirs cannot exercise those rights. The prohibition, however, never reaches data of a patrimonial nature, to which heirs keep full access. Persons or institutions expressly designated by the deceased may also act, in accordance with the instructions received.

The digital will under article 96

Beyond personal data, article 96 of the Spanish data protection law governs access to content that information society service providers hold about deceased persons: email, cloud files, profiles and posts. Relatives, heirs, executors and designated persons may approach those providers to access the content and give instructions on its use, destination or deletion, subject to the same exception of the deceased's contrary wishes and with the guarantee that the digital estate remains available to the inheritance. The connection with succession law is direct: the registry qualification of inheritance and estate planning increasingly incorporate assets of this kind.

Erasure, memorialisation and access: three different requests

Erasure means the platform deletes the account or the content. Memorialisation, offered by networks such as Facebook or Instagram, turns the profile into a memorial account: it stops appearing in suggestions and reminders, but the published content stays visible to those who already had access. Access, in turn, allows obtaining a copy of certain content, something not every platform grants and which usually requires strict proof of standing.

Each platform keeps its own channel. Google provides a request form concerning a deceased user's account and an inactive account manager that the holder can configure during their lifetime. Apple allows designating a legacy contact for the account, who will have access to certain data after death. LinkedIn offers a procedure to memorialize or close a deceased member's profile. In every case the request goes through each service's official forms, never through informal channels.

Usual documents and steps

Although each platform has its own forms, the required documentation converges: a death certificate, proof of the family tie or heir status (national ID, family record book, will or declaration of heirs, as the case may be) and precise identification of the account, usually the profile URL or email address. Gathering an inventory of services before starting, and keeping a copy of every request and reply, is advisable.

The real limits of deletion

Requesting erasure does not guarantee that every trace disappears. Backups may take weeks or months to be purged, some legal obligations require certain data to be kept for fixed periods, and content republished by third parties escapes the original platform's control. Removing results from search engines also requires a specific request to the search engine, independent of closing the account. For professional practice, handling this data fits within the general framework of data protection for the self-employed lawyer and the duty of safekeeping covered by the analysis on AI, professional secrecy and client data.

Planning ahead: the practical advice for law firms

The best management of a digital footprint starts before death. Including an inventory of digital assets in estate planning, designating legacy contacts where services allow it and leaving express instructions on the fate of profiles and content spares families a slow, fragmented process. It is a growing estate advisory service, as shown by the agenda of the Madrid bar's family and succession law congresses.

Sources: Organic Law 3/2018 (articles 3 and 96, consolidated BOE text) and the official help centres of Google, Apple and LinkedIn, verified on 2 November 2026.

Enlaces relacionados

• Data protection for the self-employed lawyer
• AI, professional secrecy and client data
• Inheritance and registry qualification: DGSJFP doctrine
• ICAM Second Family and Succession Congress