{"id":3339,"date":"2025-11-20T08:17:59","date_gmt":"2025-11-20T08:17:59","guid":{"rendered":"https:\/\/itlawco.com\/?p=3339"},"modified":"2025-11-20T08:17:59","modified_gmt":"2025-11-20T08:17:59","slug":"dsars-for-deceased-data-subjects-guidance-on-how-to-respond","status":"publish","type":"post","link":"https:\/\/itlawco.com\/fr\/dsars-for-deceased-data-subjects-guidance-on-how-to-respond\/","title":{"rendered":"DSARs for deceased data subjects: Guidance on how to respond"},"content":{"rendered":"\n\t\t
<\/div><\/div><\/div>
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\n
\n\t

What happens to your personal information after you die? As digital legacies grow and families seek access to accounts, communications, and records of deceased loved ones, organisations increasingly face requests for access to the personal data of deceased individuals. While most privacy laws, including South Africa\u2019s Protection of Personal Information Act (POPIA)<\/a>, do not apply post-mortem, the demand for access persists.<\/p>\n

This article explores how various global privacy frameworks treat data subject access requests (DSARs) on behalf of deceased individuals, with a particular focus on South African law. It also offers practical guidance for companies operating across jurisdictions on how to lawfully and ethically manage such requests.<\/p>\n

POPIA only protects the living<\/h2>\n

Section 1 of POPIA defines \u201cpersonal information\u201d as data relating to an identifiable, living natural person (and a juristic person). The rights to access, correct, or delete data under POPIA are therefore extinguished at death. This exclusion mirrors global norms, such as the EU\u2019s GDPR, which similarly excludes deceased individuals from direct protection.<\/p>\n

No post-mortem DSARs under POPIA<\/h2>\n

Because POPIA does not apply to the deceased, organisations in South Africa are not obliged to comply with DSARs made on their behalf. However, the need for access\u2014whether by family members, executors, or legal representatives\u2014remains. This requires companies to turn to other legal mechanisms such as estate law, court orders, or contract law.<\/p>\n

Alternative access mechanisms<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Mechanism<\/strong><\/th>\nLegal basis<\/strong><\/th>\nWho can use it<\/strong><\/th>\nPurpose \/ What it enables<\/strong><\/th>\n<\/tr>\n<\/thead>\n
Letters of Executorship \/ Administration<\/strong><\/td>\nAdministration of Estates Act (SA)<\/td>\nExecutor or Administrator<\/td>\nFull legal authority to access, manage, and distribute estate data<\/td>\n<\/tr>\n
PAIA Request<\/strong><\/td>\nPromotion of Access to Information Act (SA)<\/td>\nAny requester who can justify the request<\/td>\nAccess to records held by public or private bodies if needed to protect a right<\/td>\n<\/tr>\n
Court Order (Mandamus \/ Declaratory)<\/strong><\/td>\nCommon law; High Court discretion<\/td>\nExecutor, heir, or interested party<\/td>\nCompels access when refused, or resolves disputes over access<\/td>\n<\/tr>\n
Contractual Access \/ T&Cs<\/strong><\/td>\nPlatform or service provider terms<\/td>\nExecutor or legacy contact (if designated)<\/td>\nAccess or manage digital accounts (email, social media, cloud data)<\/td>\n<\/tr>\n
Digital Legacy Tool (Platform-Specific)<\/strong><\/td>\nTerms of use \/ digital asset settings<\/td>\nLegacy contact or nominated user<\/td>\nUser-defined data access or deletion (e.g. Google, Apple, Facebook)<\/td>\n<\/tr>\n
Bank \/ Insurer Data Request<\/strong><\/td>\nFICA, FAIS, Administration of Estates Act<\/td>\nExecutor with required documents<\/td>\nAccess to banking, insurance, and investment information<\/td>\n<\/tr>\n
Credit Report Request<\/strong><\/td>\nNational Credit Act (Section 70)<\/td>\nExecutor or trustee<\/td>\nView debts and liabilities of the deceased<\/td>\n<\/tr>\n
Medical Records Request<\/strong><\/td>\nHealth Professions Act; ethics codes; PAIA<\/td>\nExecutor or authorised person<\/td>\nLimited access to medical history (may require court oversight)<\/td>\n<\/tr>\n
Notarial Declaration \/ Affidavit<\/strong><\/td>\nCommon law practice<\/td>\nSurviving spouse, heir, or next of kin<\/td>\nSupports informal requests (e.g., password reset, ID verification)<\/td>\n<\/tr>\n
International Data Access (e.g. GDPR, France)<\/strong><\/td>\nEU Member State laws (e.g., France’s Art. 85 LIL)<\/td>\nHeirs or designated data heirs<\/td>\nAccess or oppose data processing post-death (jurisdiction-specific)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Living data remains protected<\/h2>\n

If deceased records include information about living individuals (e.g. family members, business associates), that portion remains subject to POPIA. Organisations must redact or protect such data unless another legal basis permits disclosure.<\/p>\n

Global approaches to post-mortem DSARs<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
Jurisdiction<\/strong><\/th>\nApplies to deceased?<\/strong><\/th>\nWho can request?<\/strong><\/th>\nMechanism<\/strong><\/th>\n<\/tr>\n<\/thead>\n
South Africa (POPIA)<\/strong><\/td>\n\u274c No<\/td>\nExecutor, heirs, legal reps<\/td>\nPAIA, estate law, court order<\/td>\n<\/tr>\n
EU (GDPR)<\/strong><\/td>\n\u274c No (Art. 1, Recital 27)<\/td>\nMember States may provide for post-mortem rules<\/td>\nVaries by country (e.g., France & Italy allow digital wills)<\/td>\n<\/tr>\n
France<\/strong><\/td>\n\u2705 Yes (Art. 85 LIL)<\/td>\nHeirs or designated digital heirs<\/td>\nAccess, deletion, or opposition rights under French Digital Republic Law<\/td>\n<\/tr>\n
Germany<\/strong><\/td>\n\u2705 Yes (BVerfG case law)<\/td>\nLegal heirs<\/td>\nInherit data and contracts as part of estate<\/td>\n<\/tr>\n
UK (UK GDPR + DPA)<\/strong><\/td>\n\u274c No<\/td>\nEstate reps (under other law)<\/td>\nData access via contract or court<\/td>\n<\/tr>\n
Canada (PIPEDA)<\/strong><\/td>\n\u274c No<\/td>\nNext of kin, executor<\/td>\nProvincial estate or contract law<\/td>\n<\/tr>\n
California (CCPA)<\/strong><\/td>\n\u274c No<\/td>\nExecutor or authorised agent<\/td>\nAccess via probate or contractual rights<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n

Practical guidance for organisations<\/h2>\n

Organisations should:<\/p>\n