Draft data protection rules include deletion of social media accounts upon death, unless relatives are nominated

This essentially means that social media companies, e-commerce firms, and online gaming companies — the three types of enterprises outlined specifically in the Rules — will have to proactively delete inactive accounts. Representational file image.
| Photo Credit: Reuters

A key provision of the draft Digital Personal Data Protection Rules, 2025 could lead to the disappearance of the social media accounts of the deceased. According to Rule 8(1) of the draft Rules, which have been issued for public comment, “A Data Fiduciary … shall erase such personal data, unless its retention is necessary for compliance with any law … if, for the corresponding time period … the Data Principal neither approaches such Data Fiduciary for the performance of the specified purpose nor exercises her rights in relation to such processing.” 

This essentially means that social media companies, e-commerce firms, and online gaming companies — the three types of enterprises outlined specifically in the Rules — will have to proactively delete inactive accounts, a provision which may erase public facing social media accounts of individuals who have died in recent years. IT Minister Ashwini Vaishnaw said in a recent interview that the Rules may have a two-year timeline for compliance, and consultations around this issue are ongoing.

Editorial | No secret affair: on the  draft Digital Personal Data Protection Rules, 2025

In the past, social media platforms have had to contend with the issue of dead users when planning purges of inactive accounts. In 2019, the erstwhile Twitter announced that old accounts that had not been used in over six months would be removed after some warnings, and their usernames would be made available. Public outrage ensued from relatives of deceased users, in addition to concern that notable accounts of public personalities would disappear from the platform. Under Elon Musk, who acquired Twitter in 2022 and renamed it X, the policy resurfaced, and accounts started disappearing in May 2023.

Meta has a process in place to memorialise accounts of the deceased in accordance with the wishes of relatives. “It’s our policy to memorialize an account for someone who has passed if a valid request is received,” the company says in a help page for Facebook. A “legacy contact” can be added by a user when they are alive in order to pass on control in the event of their demise. Similar provisions exist for Google Accounts.

The Rules formalise such arrangements, as does the parent Act. “A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder,” the DPDP Act says. 

However, users are not required to nominate someone in the event of their death, and may choose to have their accounts disappear. “Keep in mind that if the account holder requested to have their account permanently deleted after they pass away, we will remove their account once we’re made aware they have passed away,” Facebook says on memorialisation.