The Right To Nominate Under India’s DPDP Act, 2023 - A New Frontier In Digital Inheritance And Data Governance
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
THE RIGHT TO NOMINATE UNDER INDIA’S DPDP ACT,
2023: A NEW FRONTIER IN DIGITAL INHERITANCE AND
DATA GOVERNANCE
Prajna Jadhav, PhD Student, Sanchi University of Buddhist and Indic Studies. ORCID ID: https://orcid.org/0009-0007-3302-3320
ABSTRACT
The Right to Nominate, introduced under Section 14 of India’s Digital Personal Data Protection Act, 2023, marks a significant advancement in data governance. It empowers Data Principals to designate a nominee to exercise their data rights in the event of death or incapacity. This paper examines the legal, ethical, and practical implications of the right—particularly in the contexts of digital inheritance, children’s data, and personal autonomy—and explores the challenges and risks it entails. It further compares this right with similar provisions in other jurisdictions and offers recommendations to enhance implementation and prevent misuse. The effectiveness of this right will depend on public awareness, robust safeguards, regulatory oversight, and sustained stakeholder engagement to ensure a balance between empowerment and privacy.
By introducing this right, India positions itself among the few jurisdictions proactively addressing the complex intersection of privacy, technology, and end-of-life data governance. Keywords: Digital Personal Data Protection Act 2023 of India, the Right to Nominate.
1. Introduction
In the modern data economy, vast amounts of personal data are continually collected and processed. 1 This includes information that individuals actively provide to companies and governments—such as names, contact details, and preferences—as well as data that is passively gathered without their explicit awareness, such as browsing behavior, location data, or device usage patterns. Beyond merely collecting existing data, organizations increasingly generate personal data about individuals through the use of data analytics and artificial intelligence. Privacy was originally conceived as the ability to limit access to oneself. Over time, the concept has broadened to encompass dimensions such as secrecy, anonymity, and solitude.
2 In the digital era, privacy also involves control over one’s personal information, the right to make informed decisions, and the capacity to establish personal boundaries. With the rapid advancement and integration of digital technologies into everyday life, serious privacy concerns have emerged—including data breaches, pervasive surveillance, and the misuse of personal information. These challenges have prompted legislative responses worldwide aimed at safeguarding personal data and reinforcing individual privacy rights. Some notable examples are listed below. 3
CCPA
The California Consumer Privacy Act in the United States in 2018
CPRA
The California Privacy Rights Act, went into effect from on January 1, 2023, which amends and expands upon the CCPA
DPDPA
Digital Personal Data Protection Act in India in 2023
GDPR
The General Data Protection Regulation enacted in 2016 in the European Union and enforced from May 2018
PA
The Privacy Act in Australia in 1988 1Custers and Vrabec 2024: 1. 2Chopra and Kasaudhan 2024.
3 Habu and Henderson 2023: 2
PIPEDA
The Personal Information Protection and Electronic Documents Act in Canada in 2000
PIPL
Personal Information Protection Law in China in 2021
2. Legal Framework
2. 1 Data Protection Regulation Data protection regulations are legal frameworks established to safeguard individuals’ personal data and uphold their right to privacy. Historically, data protection has been closely intertwined with the broader concept of privacy. To fully understand the evolution of data protection, it is essential to trace the historical development of the concept of privacy itself. The modern legal conception of privacy can be traced to Warren and Brandeis’s seminal 1890 definition of privacy as “the right to be let alone. ” This notion gradually gained international recognition as a fundamental human right, most notably through the 1948 Universal Declaration of Human Rights, which enshrines the right to privacy in its Article 12. The European Convention on Human Rights, adopted in 1950, further reinforced this right in its Article 8.
4 The emergence of the information society in the 1970s—driven by rapid advancements in computing and data processing—led to the recognition of data protection as a distinct legal and human right. Rising concerns over the potential misuse of personal information prompted many countries, particularly in Europe, to enact legislation governing the collection, storage, and use of such data. During this period, the Council of Europe played a pivotal role in shaping a coherent legal framework for data protection, thereby laying the foundation for future international standards. The GDPR of the European Union is widely regarded as one of the most significant and influential legal instruments ever enacted to safeguard personal data and privacy. It has established a global benchmark for how organizations collect, process, and protect individuals’ information.
In response to growing concerns over data privacy, many countries have developed their own data protection frameworks. Collectively, these laws reflect a growing international
4 Habu and Henderson 2023: 2.
commitment to upholding individual privacy rights in the digital age. 5 2. 2 Data Principal Rights Data Principal Rights are legal entitlements granted to individuals, empowering them with control over their personal information. These rights obligate organizations that collect or process personal data to act transparently, fairly, and with due regard for individual privacy. By enabling individuals to make informed choices about how their data is used, these rights reinforce personal autonomy in the digital sphere. When individuals are aware of their rights and the protections available, they are more likely to trust digital services and actively participate in the digital economy. Chapter Three of the DPDPA delineates four rights conferred upon data principals, while also imposing corresponding obligations on data fiduciaries, significant data fiduciaries, and data processors.
These rights aim to empower individuals and promote accountability in the handling of personal data. They are as follows. • Right to access information about personal data • Right to correction and erasure of personal data • Right to grievance redressal • Right to nominate
3. Right to Nominate
The “Right to Nominate” under Section 14 of the DPDPA, 2023, together with the procedural framework outlined in Rule 13 of the Draft DPDP Rules, 2025, introduces a novel and forwardlooking provision in the evolving field of digital inheritance. This right allows individuals to designate one or more trusted nominees to exercise their data rights in the event of their death or incapacity, thereby ensuring that their personal data is managed in accordance with their preferences. The Act defines incapacity as the inability to exercise rights due to unsoundness
5 Habu and Henderson 2023: 1–12.
of mind or infirmity of body. 6 This broad definition is inclusive of a range of physical and mental conditions, thereby ensuring that individuals facing such challenges can still have their data rights exercised on their behalf by a nominated representative. Once a nominee is designated, they are legally empowered to act on behalf of the Data Principal in relation to their data rights. This includes actions such as accessing personal data, requesting its correction, or seeking its erasure, in accordance with the provisions of the DPDPA. For example, an elderly individual may designate their child as a nominee to manage their digital accounts and personal data in the event of deteriorating health or cognitive decline. This ensures that their personal information is handled in accordance with their wishes, even when they are no longer able to make decisions themselves.
The DPDPA introduces a progressive and forward-looking provision that recognizes the continuity of personal data rights beyond an individual’s active participation. By permitting the nomination of a representative to exercise these rights in cases of death or incapacity, the Act ensures that personal data is protected and managed in accordance with the individual’s preferences. In doing so, it reinforces the foundational principles of autonomy and privacy in the digital age.
4. Implications of the Right to Nominate
4. 1Impact on Digital Inheritance and Data Management As individuals accumulate vast amounts of personal data across digital platforms—ranging from emails and cloud storage to financial accounts and social media profiles—there is a growing need for a structured process to manage such data in the event of death or incapacity. By allowing data principals to nominate a trusted representative to exercise their data rights, the DPDPA ensures continuity in data management. This provision not only reinforces personal autonomy but also offers clarity to data fiduciaries regarding whom to engage with under such circumstances. Furthermore, it helps minimize potential conflicts among family members, prevents the misuse of sensitive personal data, and encourages responsible digital legacy planning.
In the broader context, it positions India among the few jurisdictions taking proactive steps to address the complex intersection of privacy, technology, and end-of-life data
6 Digital Personal Data Protection Act, 2023.
governance. a. A Legal Framework for Digital Inheritance Prior to this provision, Indian law lacked a clear framework for determining who could access or manage a person’s digital data after their death. The introduction of the Right to Nominate addresses this gap by granting individuals the legal authority to designate a trusted person to handle their data in such circumstances. This provision brings muchneeded structure and clarity to what was previously a legally grey area. b. Control Over Posthumous Data This right empowers individuals to determine the fate of their digital assets—such as emails, cloud files, social media accounts, and financial records—after their death or incapacitation. It ensures that their digital legacy is managed in accordance with their preferences, whether that entails deletion, archiving, or transfer to designated family members. c.
Reducing Disputes and Confusion By clearly identifying who may act on behalf of a deceased or incapacitated individual, this right helps prevent potential conflicts among family members or between legal heirs and service providers. It also provides clarity to data fiduciaries regarding whom they are legally authorized to engage with and what actions they are permitted to undertake. d. Promoting Responsible Data Management The Right to Nominate also encourages individuals to proactively consider and plan for the future management of their digital data. This fosters a culture of digital responsibility, ensuring that personal data is not left unmanaged or exposed once an individual is no longer capable of overseeing it themselves. e. Influence on Global Practices India is among the few countries to formally recognize digital inheritance within its data protection framework.
This recognition may serve as a model for other countries
as they develop comparable rights, particularly in response to the growing global awareness of digital legacies.
4.2 Potential Challenges and Concerns
While the introduction of the Right to Nominate under the DPDPA represents a progressive development, its practical implementation may raise significant concerns. For instance, individuals—particularly the elderly or otherwise vulnerable—may be susceptible to coercion or undue influence in designating nominees who do not genuinely represent their interests. This risk is especially acute in cases involving diminished capacity or dependency. Additionally, in the absence of clearly defined legal procedures, familial disputes may arise if multiple parties assert competing claims to manage the deceased’s digital data or assets. Such conflicts could hinder enforcement and potentially escalate into protracted legal proceedings.
To address these challenges, the regulatory framework should incorporate robust safeguards, including identity verification, documentation protocols, and well-defined dispute resolution mechanisms. a. Verification of Death or Incapacity One of the primary challenges lies in verifying whether the Data Principal is, in fact, deceased or incapacitated. In the absence of clear, tamper-proof procedures, there exists a significant risk of misuse—for instance, unauthorized access by an individual falsely claiming to be the designated nominee. b. Identity Verification of Nominees Ensuring that the individual exercising the rights of a nominee is indeed the person designated by the Data Principal can be challenging. Inaccurate records or inadequate verification mechanisms may result in unauthorized access, misuse, or even permanent deletion of the data by an unintended party. c.
Data Fiduciary Readiness Many organizations—particularly smaller businesses and digital platforms—may lack the necessary systems or infrastructure to process nomination requests effectively. This institutional gap could result in inconsistent practices, delayed responses, or even failure to honor valid nominations, thereby undermining the intent of the provision.
d. Lack of Public Awareness For the Right to Nominate to be effective, individuals must be aware of its existence and understand the procedures for exercising it. However, digital literacy in India remains uneven, and a significant portion of the population may be unaware of this provision or lack the knowledge required to navigate the nomination process. e. Risk of Data Misuse by Nominees There remains a risk that nominees may misuse access to sensitive personal data, particularly in the absence of robust accountability mechanisms. For instance, a nominee could exploit financial information or confidential documents for personal gain, leading to potential violations of privacy, trust, and even legal norms. f. Legal Disputes and Inheritance Conflicts The Right to Nominate may conflict with traditional inheritance laws or the provisions of a will.
In cases where multiple individuals assert a claim to a deceased person’s data, or where a will contradicts a digital nomination, legal disputes may arise. g. Absence of Global Interoperability Data managed by international platforms—such as global cloud service providers or social media companies—may not readily recognize or enforce nominations made under Indian law. This could give rise to jurisdictional conflicts and undermine the effectiveness of the right. h. Exploitation of Children's Data In cases where a parent or guardian nominates an individual to manage their child’s personal data, the nominee is expected to act in the best interests of the child. However, if the nominee misuses this authority—by selling, sharing, or otherwise exploiting the child’s personal information—it can result in long-term harm.
Given that children are often unaware of their digital rights and lack the legal capacity to challenge such actions, the risk of unnoticed or unaddressed abuse becomes particularly significant. 7 7Available at https://www. dpdpa. com/blogs/righttonominatedpdpadigitalafterlife. html#:~:text=The%20Essence%20of%20the %20Right,of%20their%20demise%20or%20incapacity
5. Comparative analysis with other Jurisdictions
A comparative analysis of the PA, CCPA, PIPEDA, and GDPR with the DPADA is presented
in Table 1. Certain salient comparative features of India’s DPDPA and China’s PIPL regarding the right to nominate are compiled in Table 2. The DPDPA introduces a progressive and legally explicit provision that empowers the data principal, whereas the PIPL of China adopts a more culturally contextual and reactive approach, balancing data protection with traditional family involvement. Article 49 of the PIPL stipulates that, upon the death of a natural person, close relatives may exercise the deceased’s rights—such as access, copy, correction, or deletion of personal data— unless the deceased had made alternative arrangements prior to death.8 The purpose of this provision is to ensure posthumous protection and control over personal data, albeit within a kinship-based framework. Table 1 Jurisdiction Provision/Concept Key Features Comparison with the
DPDPA
Australia:
PA
Data rights generally lapse upon an individual’s death. Estate laws may grant limited access, but they do not provide a nomination mechanism. The DPDPA takes a pioneering approach, whereas Australia’s framework remains more traditional.
Canada:
PIPEDA
The
DPDPA
offers stronger protections and a clear process, whereas Canada relies on indirect legal interpretation. The
PIPEDA
remains silent on post-death data rights, which are typically governed by estate law. The PIPEDA focuses on the data rights of living individuals; post-death data rights are subject to state laws.
EU: GDPR
The GDPR provides no explicit postdeath rights, which vary across member countries. The GDPR is silent on post-death data rights; however, countries like France grant certain rights to heirs, while Germany treats personal data as inheritable. The DPDPA adopts a more structured and unified approach, whereas the GDPR defers to local laws, resulting in inconsistency. Table 2 Feature The DPDPA The PIPL Applicability of the Death or Incapacity Death only right Actor on post-death Nominated person Close relative
digital realm but also offers operational clarity to data fiduciaries regarding posthumous data governance. The PIPL, by comparison, provides more limited posthumous data rights, focusing primarily on the lawful interests of the deceased’s next of kin and lacking a structured nomination mechanism.
6. Suggestion
For the Right to Nominate to be truly effective and resilient against potential misuse, it must be underpinned by a robust legal, institutional, and technical framework. The following are key recommendations aimed at strengthening its implementation and mitigating the risk of abuse. a. Mandatory Identity Verification To prevent unauthorized or fraudulent nominations, the process should mandate identity verification for both the Data Principal and the nominee. Acceptable methods may include Aadhaar-based e-verification, digital signatures, or submission of notarized forms. Ensuring that nominees are properly authenticated at the time of nomination significantly reduces the risk of impersonation, misrepresentation, or subsequent misuse. 9 b.
Judicial and Regulatory Oversight In certain cases—particularly those involving children’s data or high-risk categories of personal data, such as health or financial information—the nomination should be subject to judicial approval or review by the Data Protection Board. Introducing this additional layer of oversight would help ensure that such nominations align with the best interests of the Data Principal, especially in situations where the individual is vulnerable or incapable of providing fully informed consent. 10 I also recommend the following:
9https://www.dpdpa.com/blogs/righttonominatedpdpadigitalafterlife.html#:~:text=The%20Essence%20of%20th e%20Right,of%20their%20demise%20or%20incapacity. 10https://www.dpdpa.com/blogs/righttonominatedpdpadigitalafterlife.html#:~:text=The%20Essence%20of%20th e%20Right,of%20their%20demise%20or%20incapacity.
c. Scope-limited and Purpose-specific Nominee Access The rights of a nominee should be limited in scope, permitting access only to specific categories of personal data or digital services explicitly designated by the Data Principal. Such restrictions would prevent blanket access to all personal information and ensure that nominees operate within clearly defined boundaries. Furthermore, access should be purpose-specific—for instance, limited to retrieving essential documents or deleting accounts—and should not extend to managing financial data unless expressly authorized. d. Nominee’s Access by a Formal Notification To prevent conflicts or confusion—particularly in the event of the Data Principal’s death—the nominee’s access to personal data should be accompanied by a formal notification to the next of kin or legal representatives.
Such a mechanism ensures transparency by informing family members of the designated nominee and enables them to raise objections or concerns if any irregularities arise. e. Time-Bound and Conditional Access The nominee’s access to personal data should be time-bound and subject to automatic revocation after a specified period, unless formally extended by a legal order. In situations involving incapacity, such access should not be granted by default but should be contingent upon verified medical or legal documentation confirming the Data Principal’s condition. f. Awareness and Education Campaigns To promote responsible use of the Right to Nominate, both the government and data fiduciaries should undertake targeted awareness campaigns.
These initiatives should educate individuals on how to nominate a trusted person securely, outline potential risks, and provide clear guidance on reporting misuse or abuse. An informed public is essential to mitigating the risk of accidental, uninformed, or coerced misuse of this right.
7. Conclusion
The Right to Nominate represents a pioneering development in responding to the evolving
complexities of data management in the digital age—an age in which our digital presence is inextricably linked to everyday life. While the intent behind this provision is forward-looking, its long-term efficacy hinges on the implementation of clear procedures, robust safeguards, and effective oversight mechanisms. To ensure that the right operates as intended—empowering individuals while preserving their privacy and digital legacy—there must be sustained public discourse, meaningful stakeholder engagement, and periodic refinement of the legal and regulatory framework. Only through such a dynamic and inclusive approach the Right to Nominate can emerge as a meaningful and enduring pillar of modern data protection law.
References Regulations • California Consumer Privacy Act, 2018. California Privacy Rights Act, 2023. Available At https://leginfo. legislature. ca. gov/faces/codes_displayText. xhtml? division=3. &part=4. &lawCode=CIV&title=1. 8 1. 5 • Digital Personal Data Protection Act, 2023. Draft Digital Personal Data Protection Rules, 2025. Available at https://www. meity. gov. in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5. pdf • Draft Digital Personal Data Protection Rules, 2025. Available at https://static. mygov. in/innovateindia/2025/01/03/mygov-999999999568142946. pdf • General Data Protection Regulation, 2018. Available at https://gdpr-info. eu/ • Personal Information Protection and Electronic Documents Act, 2000 Available at https://laws-lois. justice. gc. ca/eng/acts/p-8. 6/ • Personal Information Protection Law, 2021. Available at https://personalinformationprotectionlaw.
com/PIPL/hello-world/ • The Privacy Act, 1988. Available at https://www. legislation. gov. au/C2004A03712/asmade/text Research Papers • Adamu Adamu Habu and Tristan Henderson. Data subject rights as a research methodology: A systematic literature review. Journal of Responsible Technology 16 (December 2023) 1–12. https://doi. org/10. 1016/j. jrt. 2023. 100070 • Bart Custers and Helena Vrabec. Tell me something new: data subject rights applied to inferred data and profiles. Computer Law & Security Review: The International Journal of Technology Law and Practice (April 2024) 1–14.
https://doi.org/10.1016/j.clsr.2024.105956 • Khushi Chopra and Surya Pratap Kasaudhan. From Constitutional Rights to Data Protection: Article 21 and Comparative Perspectives on Privacy. Manupatra (July 2, 2024). Available at https://articles.manupatra.com/article-details/From-Constitutional- Rights-to-Data-Protection-Article-21-and-Comparative-Perspectives-on-Privacy Website Links • https://www.dpdpa.com/blogs/righttonominatedpdpadigitalafterlife.html#:~:text=The %20Essence%20of%20the%20Right,of%20their%20demise%20or%20incapacity