Nominated but Not Protected: Why The DPDPA's Post-Mortem Framework Betrays Puttaswamy

[Yash is a student at Hidayatullah National Law University.]

In January 2026, Sadhna Shaishav Shah approached the Gandhinagar district court to seek access to and recovery of her deceased husband’s digital estate which included an Apple iPhone 13 Pro Max and an associated Apple Account which contained valuable personal data of emotional, sentimental and practical significance to her. Since Section 14 of the Digital Personal Data Protection Act 2023 (DPDPA) does not come into force until May 2027, no nomination mechanism existed at the time of Shaishav's death. Consequently, Sadhna had no statutory recourse under the DPDPA to govern how the personal data of the deceased is treated. The court had to resort to 100-year-old Indian Succession Act 1925, which was designed for tangible property.

The DPDPA was enacted under the constitutional obligation of Justice KS Puttaswamy v. Union of India (Puttaswamy), which established privacy as a fundamental right and held that privacy is rooted in dignity and autonomy under Article 21 of the Constitution of India. Section 14 of the DPDPA introduces a “right to nominate” allowing a data principal to designate someone to exercise their Data rights after death or incapacity.

This is the beginning, but this is not enough. This piece argues that the DPDPA’s post-mortem framework, when measured against Puttaswamy’s dignity based privacy foundation, is structurally inadequate by conditioning posthumous privacy protection on the foresight of living, leaving the un-nominated dead unprotected.

The Legal Gap: What the DPDPA Says and What It Does Not

Post-mortem privacy has been defined by Lilian Edwards and Edina Harbinja (2013) as the right to control how one is remembered and what is revealed after death. The DPDPA defines “data principal” as the individual to whom personal data relates including children through parents/guardians and persons with disabilities through their guardians. Further, Section 14 introduced the “right to nominate,” enabling a data principal to appoint someone to exercise their rights after death or incapacity.

This framework conditions posthumous privacy protection on the foresight of living person. Therefore, if the data principal dies without nominating someone under Section 14, then the posthumous privacy of the person remains unprotected. This statutory gap is also recognised and highlighted by the court in Sadhna Shaishav Shah v. Nil (Sadhna Shah case).

Furthermore, nomination does not equate to inheritance. This was held by the court in Sarbati Devi v. Usha Devi, and Shakti Yezdani v. Jayanand Jayant Salgaonkar, while dealing with insurance policies and company shares respectively. Since a nominee does not hold absolute rights and can be challenged by legal heirs, it creates a conflict between the DPDPA nominee and succession law claimants.

Puttaswamy's Promise: Why Dignity Does Not Extinguish at Death

In Puttaswamy, Justice Chandrachud's opinion, grounded the right to privacy not in procedural entitlement but in the substantive values of dignity and autonomy. The judgement held, “dignity cannot exist without privacy." Privacy was framed as a positive attribute of personhood, inseparable from what it means to live as a free human being. 

This dignity-based framework carries a critical implication that the DPDPA’s drafters seemed to have overlooked. If privacy attaches to the dignity and personhood of the individual, the question of whether it survives death depends upon whether dignity survives after death.

Consider the existing legal provisions. Section 356 of Bharatiya Nyaya Sanhita 2023 protects the reputation of deceased persons from defamation. Further, Section 22 of the Copyright Act 1957 stipulates that copyright survives during the lifetime of the author and extends for 60 years beginning from the calendar year following the author's death. The law has consistently recognised that some interests of the person survive, and deserve protection.

It is true that Justice Sapre, in his concurring opinion in Puttaswamy, observed that the right to privacy, being an inherent right, is born with the human being and extinguishes with the human. However, Justice Sapre’s observation on this point was not necessary to decide the case, it was not adopted by the majority and therefore, it cannot be treated as a binding ratio. In the Sadhna Shah case, court made exactly this error, which is to treat Justice Sapre’s observation as a settled proposition and applied actio personalis moritur cum persona (a personal right of action dies with the person) on that basis. To allow Justice Sapre's obiter to override the majority's dignity-based framework and to allow the DPDPA to encode that override in statute, would be to subordinate the ratio to a concurrence.

Opt-In by Design: How Section 14 Fails the Un-Nominated Dead

This nomination feature is both fundamentally and structurally inadequate․ First‚ it creates a system in which privacy is not protected on an equal footing‚ but rather follows the old lines of social disadvantage․ An English-speaking urbanite with merely a passing acquaintance with the Internet can make sense of the nomination feature under Section 14․ The weak and the widow in a remote part of Chhattisgarh would not․ A right founded on dignity‚ as Puttaswamy holds‚ is not for the digital elite‚ it is for all‚ irrespective of their social or economic status․ 

Secondly‚ despite the nominee being responsible for deciding privacy matters under Section 14‚ this does not extend to the right to claim the economic value of the digital property․ Nevertheless‚ it creates yet another conflict for families and will likely result in disputes between the nominee and heirs at law․ In Sadhna Shah case‚ the court decided to treat the digital data as property of estate and devolve its rights upon the legal heirs in accordance with the provisions of the Indian Succession Act 1925․ This could only happen because there was no nominee appointed under Section 14 of the DPDPA․ Imagine a situation where nominee is appointed under Section 14 of the DPDPA, but the legal heirs want access to the digital estate. In the event of a conflict between them, neither statute elucidates which prevails. 

Lastly, there is no default protection for the person who died without nominating someone. If a person dies without nominating someone under Section 14 of thr DPDPA, data fiduciary can theoretically retain and process a deceased person's data indefinitely with no legal obligation to delete it. They can use it for profiling, sell it to third parties, or retain it as part of their data infrastructure, without any consequence under the DPDPA. Furthermore, the very institution created to enforce data protection rights i.e., the Data Protection Board, has no explicit jurisdiction to receive complaints about posthumous data from non-nominees. Under Section 27 of the DPDPA, the board’s jurisdiction is limited to complaints by data principals or their nominees. The un-nominated deceased has no recourse, and neither does anyone acting on their behalf.

From Opt-In to Guarantee: A Three-Tier Framework for Posthumous Privacy

The DPDPA needs a reconceptualisation of post-mortem data regulation as a graduated scheme to meet the dignity based constitutional standard required by Puttaswamy.

Section 14 should be amended to require platforms to encourage users to appoint a nominee rather than burying the feature in settings. Platforms must offer the nomination feature in all scheduled languages under the Eighth Schedule of the Constitution, ensuring accessibility beyond English-literate urban users and individuals who are unaware of this nomination mechanism.

In the absence of nomination, legal heirs under the Indian Succession Act 1925 should have statutory standing to exercise data rights under DPDPA. Further, in the event of contention between the appointed nominee and the legal heirs, regarding data rights of the deceased, a statutory hierarchy clause should be incorporated that explicitly determines which right prevails in which circumstance, depending on the nature of claim being made. 

In the absence of such nominee or legal heirs‚ the data fiduciary should delete un-nominated and un-claimed data of a confirmed deceased person within a period of 2 years from the date of verification of death․ Additionally‚ the Data Protection Board should be conferred with the jurisdiction to deal with the complaints by legal heirs in absence of nominee‚ and to see whether a data fiduciary has complied with the rule to delete the data of a confirmed deceased person in the specified time period․

These proposed amendments ensure that the constitutional guarantee of privacy rooted in dignity, as envisaged in Puttaswamy, is extended meaningfully to the deceased. Jurisdictions such as France, through the amended Loi Informatique et Libertés (Information Technology, Data Files and Civil Liberty Act), have already demonstrated that a tiered posthumous data protection framework is legislatively feasible. Had these amendments been in place, Sadhna Shah case would not have needed to approach a civil court under a century-old succession statute to assert what is, at its core, a constitutional right.

Conclusion

The Sadhna Shah case exposed the real statutory lacuna that exists in the way the DPDPA treats posthumous privacy. If dignity is genuinely the foundation of the right to privacy, as Puttaswamy held, then the DPDPA, which was enacted under the constitutional obligation created by Puttaswamy, cannot discharge that obligation through an opt-in nomination feature that most intended beneficiaries will never use. If this contradiction is not resolved, courts will be compelled to do what the Gandhinagar district court did in Sadhna Shah case i.e., to resolve the constitutional questions through creative interpretation of century-old statutes, producing inconsistent outcomes across jurisdictions with no constitutional coherence. That is not a dignity framework. That is judicial improvisation in the place where legislative design should be.