DPDP Act: India's Right to Nominate Gaps Challenge Fiduciaries

• India's Digital Personal Data Protection Act, 2023, introduces a "right to nominate" for digital data.
• Section 14(1) of the DP Act allows individuals to appoint a nominee to exercise their data rights upon death or incapacity.
• The Act grants broad authority to nominees, enabling them to act as the data principal.
• Despite this, the law lacks detailed procedures, creating gaps in its operational machinery.
• Ambiguity exists regarding whether digital data constitutes "property" for succession, potentially causing conflicts between nominees and legal heirs.

The absence of a clear framework for digital data succession India means that data fiduciaries must anticipate and prepare for scenarios where competing claims over digital assets arise.

The increasing digitization of personal lives has brought to the forefront a critical question: what happens to an individual's digital data when they pass away or become incapacitated? This growing concern necessitates clear legal frameworks to manage digital assets and personal information posthumously or during periods of incapacitation. India's recent data protection legislation seeks to address this by introducing a specific right allowing individuals to nominate a representative for their digital data.

This legislative effort, however, presents a significant challenge for data fiduciaries, who are tasked with implementing the provisions of the law. While the Digital Personal Data Protection Act, 2023 (DPDP Act) establishes the "right to nominate," it simultaneously creates certain gaps in its operational machinery. These gaps require data fiduciaries to proactively develop robust internal procedures to ensure full compliance with the spirit and objectives of the new legislation, particularly concerning the India data nomination procedure.

Central to addressing digital data succession in India is Section 14(1) of the Digital Personal Data Protection Act, 2023. This crucial provision empowers a data principal—the individual whose data is being processed—to designate another person. This nominated individual is then authorized to exercise the data principal's statutory rights under both the DP Act and the Digital Personal Data Protection Rules, 2025, in the event of the data principal's death or inability to manage their affairs.

The scope of authority granted to such a nominee is notably extensive. The Act intends for the nominated person to effectively step into the shoes of the data principal, wielding the same powers and rights as the original individual regarding their digital personal data. This broad authorization underscores the legislative intent to provide a mechanism for continuity and control over personal digital information, even when the data principal is no longer able to act on their own behalf.

Despite the clear intent to fill a genuine need, the current legislative framework for the DPDP Act right to nominate gaps in its practical implementation. While the right itself is established, the specific "machinery" or detailed procedures for its operation are described as thin. This lack of explicit guidance creates considerable ambiguity for all parties involved, including data fiduciaries, nominees, and legal heirs.

A significant contributing factor to this ambiguity is the undeveloped legal position on whether digital personal data can be classified as "property" capable of traditional succession. This uncertainty can lead to direct conflicts, particularly when a legal heir asserts a claim that competes with the rights exercised by a designated nominee. Although Section 38 of the DP Act stipulates that the Act prevails in cases of conflict with other laws, it notably does not provide clarity on issues related to succession or the access rights of heirs, leaving these critical questions unresolved.

The existing legislative gaps surrounding the India data nomination procedure present a complex challenge for data fiduciaries. Without comprehensive statutory guidance, these entities face the risk of navigating disputes between nominees and legal heirs, potentially leading to compliance issues and legal complications. The absence of a clear framework for digital data succession India means that data fiduciaries must anticipate and prepare for scenarios where competing claims over digital assets arise.

To mitigate these risks and ensure robust data fiduciary nomination compliance, it is imperative for organizations to develop their own detailed internal procedures. These procedures should aim to clarify how nominations are registered, verified, and acted upon, as well as how potential conflicts between nominees and legal heirs will be addressed. Proactive development of such internal protocols is essential for upholding the objectives of the DPDP Act and safeguarding individuals' digital rights effectively.

Lawyers and compliance officers must advise data fiduciaries on developing robust internal procedures for the 'right to nominate' under India's DPDP Act, despite the current legislative gaps. This is crucial to ensure compliance, mitigate potential conflicts between nominees and legal heirs regarding digital data, and address the ambiguities surrounding digital asset succession.

Source: Insights from legal commentary