What Happens to Your Digital Life When You Die?
Digital legacy planning is more than writing down passwords. Separate what should be cancelled, preserved or transferred; give the right people lawful authority and a safe route to act; and use provider tools such as Facebook Legacy Contact, Apple Legacy Contact and Google Inactive Account Manager where they fit. This UK guide includes probate, Tell Us Once, cryptoassets, business key-person risk, a Digital Legacy Check and a printable one-page plan.
When someone dies, their digital life does not arrive in one tidy folder for the family to deal with. It is scattered across an inbox, a phone, cloud storage, social networks, banking and shopping apps, subscriptions, photographs, cryptoasset services, a password manager, domains, websites and perhaps a business.
Some of those accounts need to be closed quickly. Some contain memories that should be preserved. Some are assets or contracts that need to be dealt with by an executor or another authorised person. A few are the keys to everything else. The practical problem is not simply remembering passwords: it is making decisions in advance and creating a lawful, secure route for someone to carry them out.
Do not put passwords, PINs, MFA codes, recovery keys or crypto seed phrases in a will or in an ordinary shared document. A will becomes a legal document that may be inspected, and an open list of credentials can become a security incident while you are alive.
The short answer
Your digital life needs a plan, not a single handover. Make an inventory, decide whether each item should be cancelled, preserved or transferred, and record where the lawful authority and secure instructions are held. Name a trusted person to find the plan, but do not give them a standing invitation to impersonate you or defeat MFA.
- A provider account is not automatically an estate asset that somebody else can log into.
- Technical access and legal authority are different: a password may open a screen, but it does not prove somebody is entitled to use the account or act for the estate.
- Use the provider's own legacy, memorialisation, bereavement or executor process wherever one exists.
- Keep recovery information and passwords in a reputable password manager or other protected arrangement, with instructions for lawful access rather than the secrets in the will.
- Review the plan annually and after major changes such as a new phone, new email address, marriage, divorce, business sale or a new cryptoasset wallet.
This article is general information for UK readers, not legal, tax or financial advice. The law, provider products and account terms change; check the current provider and GOV.UK position before acting.
Digital legacy planning is not a password list
A password list answers one narrow question: “What string might let somebody sign in?” A digital legacy plan answers more useful questions: “What exists?”, “What should happen to it?”, “Who is allowed to make that decision?”, “What evidence will a provider ask for?” and “How can the person act without weakening security or privacy for everybody else?”
| Layer | What to plan |
|---|---|
| Inventory | The services, devices, data, assets, subscriptions and responsibilities that exist, including things that do not appear on a monthly bank statement. |
| Decision | Whether each item should be cancelled, preserved, transferred, memorialised, archived or reviewed by a professional. |
| Authority | The will, grant of probate or letters of administration, power of attorney while you are alive, business authority, joint ownership or provider-specific designation that gives someone a lawful route to act. |
| Secure access | Where the plan is stored, who can locate it, how a password manager's emergency-access feature works and how MFA or device access is handled. |
| Instructions | Your wishes about photos, messages, social profiles, websites, subscriptions, devices, cryptoassets and business systems, without placing the underlying secrets in the instructions. |
A person you trust may be able to locate your plan without being entitled to read every message or operate every account. Conversely, an executor may have legal responsibility for estate assets without being granted technical access by a provider. Plan for both sides of that boundary.
Three decisions: cancel, preserve or transfer
Classifying each digital item makes an overwhelming job manageable. Use the three actions below as a first pass, then record any special provider or legal route.
| Action | Typical examples | Planning question |
|---|---|---|
| Cancel | Streaming, software, app, gym, cloud or domain renewals; marketing lists; online services that should not continue billing. | Who will identify the contract, stop renewal and keep evidence of cancellation? |
| Preserve | Family photographs, videos, writing, music, messages or a memorialised social profile. | What should be kept, who should receive a copy and which privacy boundaries still apply? |
| Transfer or review | Money, cryptoassets, a domain, a website, a business mailbox, paid-for licences, intellectual property or a customer-facing account. | Who has authority, what does the provider require and what professional advice is needed? |
Do not assume “transfer” means “give a friend the login”. A service may prohibit account sharing, contain other people's personal data or require an executor, company officer or named beneficiary to use a formal process.
Provider comparison: Facebook, Apple, Google and Microsoft
Provider tools are useful, but they are not interchangeable. Configure them while you have capacity, save the relevant instructions safely and tell the right person that a plan exists. A legacy contact is not automatically an executor, and an executor is not automatically a legacy contact.
| Provider | Useful planning option | Important boundary |
|---|---|---|
| For a main Facebook profile, Facebook says you can choose a legacy contact to look after a memorialised profile, or choose permanent deletion. A legacy contact can do limited tasks such as a pinned post, profile or cover photo changes, requesting removal and, where available, downloading a copy of what you shared. | The role is limited and begins after memorialisation. It is not a login, does not make the person you and does not give them access to private messages. Family or an authorised representative can use Meta's memorialisation or removal process with the requested documentation. | |
| Apple | Apple Legacy Contact uses an access key and an Apple-issued process to request access to certain account data after death. Apple also requires the legal documentation for the country or region. The access key may be held in Apple Account settings, printed or included in estate-planning documents. | It is not a master key to every Apple service. Apple says some data is unavailable, and a locked device protected by a passcode may have to be erased rather than unlocked. A request for account deletion is a different route. |
| Google Inactive Account Manager lets you choose an inactivity period, notify trusted people and share selected account data, or set deletion instructions. Google says it may delete an account and its activity and data after at least two years of inactivity if no plan is set. | Inactivity is not the same thing as death, and the notifications, data choices and timing need to be configured deliberately. Google also has a separate deceased-user request process; it does not promise to provide passwords or transfer an account. | |
| Microsoft | For Outlook.com, OneDrive and other personal Microsoft services, start with Microsoft's current deceased-user support process and the estate's formal documents. For a business tenant, use the organisation's administrator and offboarding process rather than a personal-account workaround. | Microsoft's support guidance says it is generally unable to provide information to non-account holders. It says a personal account without access is closed automatically after two years of inactivity; a Microsoft 365 work or school account has a different owner, administrator and offboarding route. |
Provider policy changes. These links were checked on 28 August 2026; open the current page when the plan is created or reviewed.
Facebook Help Centre — About legacy contacts on Facebook →
Meta Transparency Centre — Memorialisation policy →
Apple Support — Request access to a deceased family member's Apple Account →
Google Account Help — About Inactive Account Manager →
Google — Submit a request regarding a deceased user's account →
The UK legal and administrative context
The legal route depends on what the item is, who owns it, where the person lived and which part of the UK is involved. A digital account can contain personal correspondence, third-party data, intellectual property, a contract or something with financial value. Treat the plan as a way to help the right person find and classify things, not as a substitute for a will or professional advice.
Probate and the estate
In England and Wales, the executor named in a will may need a grant of probate to deal with assets and organisations. Where there is no will, or the named person cannot act, the route may be letters of administration. Scotland and Northern Ireland have different terminology and processes. Include digital assets and obligations in the information you give the executor, but do not assume a provider will accept a private note as proof of authority.
A digital legacy plan should point to the location of the will, relevant financial records, business documents and secure credentials without reproducing them. If an account contains other people's confidential information, a professional can help decide what may be accessed, copied or disclosed.
Tell Us Once is useful, but it is not a digital-account handover
GOV.UK's Tell Us Once service lets you report a death to most government organisations and council services in one go. It can reduce repeated notifications, but it does not close a social-media account, transfer a domain, recover an inbox, cancel every subscription or tell a private provider what to do. Keep a separate private-provider list.
GOV.UK — What to do after someone dies: Tell Us Once →
GOV.UK — What to do after a death →
What to include in your inventory
Start with categories rather than trying to remember every app. Record the service name, what it contains, the intended action, the likely owner, the route to authority and where supporting information is held. Do not copy passwords or recovery secrets into the inventory.
| Area | Do not forget |
|---|---|
| Primary inboxes, old addresses, aliases, forwarding rules, recovery email, mailing lists, invoices, receipts, account alerts and the risk that an inbox can reset other accounts. | |
| Phones and MFA | Handsets, SIMs, eSIMs, authenticator apps, passkeys, trusted devices, recovery codes, mobile contracts and which number receives security prompts. |
| Photos and files | Phone galleries, computer folders, external drives, OneDrive, iCloud, Google Photos, shared albums, family archives and backups. |
| Subscriptions | Streaming, software, news, memberships, storage, gaming, app stores, direct debits, annual renewals and services paid through another provider. |
| Money and cryptoassets | Banks, payment apps, exchanges, brokerages, wallets, hardware wallets, recovery phrases, staking, NFTs and tax records. Record location and ownership, not the secret phrase in this document. |
| Password manager | The manager itself, emergency-access or trusted-contact method, recovery route and instructions for what the trusted person may do. Keep the vault encrypted and do not email an export. |
| Domains and websites | Registrar, hosting, DNS, SSL certificates, renewal dates, code repositories, analytics, ad accounts, content ownership and the person who can maintain or close the site. |
| Business access | Microsoft 365 or Google Workspace admin roles, payroll, banking, CRM, accounting, social pages, supplier portals, backups, licences, customer data and any single employee or founder who is the only administrator. |
The tricky parts people discover too late
Email is both an archive and a reset button
An inbox may contain years of personal correspondence, family photographs and purchase records. It may also be the recovery address for banking, shopping, social and business accounts. Decide whether the priority is preservation, a short supervised search, a formal provider request or closure. Do not create a broad “read everything” instruction when a narrower export or search would meet the need.
Phones and MFA can block the right person
A phone may hold passkeys, authenticator accounts, photo libraries and the only copy of recovery codes. A SIM or number may be cancelled or reassigned after a contract ends, so it is not a durable legacy plan. List the devices and MFA methods, keep backup methods current and make sure the lawful person knows how to start the provider's process without trying to impersonate the account holder.
Never ask someone to disable MFA, forward one-time codes, guess a PIN, use your unlocked phone as if they were you or enter a deceased person's account under their identity. These actions can expose other people and can breach provider terms or the law.
Photos need a preservation decision
“The photos are in the cloud” is not a backup plan. Record which service is the source, whether the files are also copied elsewhere, which albums include other people's data and who should receive a copy. State whether family members may curate, whether private photographs should remain private and whether an archive should be exported before an account is closed.
Subscriptions have a long tail
Annual renewals are easy to miss because they may not appear every month. Search bank and card statements, email receipts and app-store purchase history. Note the renewal date, customer number if relevant and the cancellation route. Keep a short list for the person handling immediate administration, separate from the longer-term archive.
Cryptoassets need visibility and careful handling
Cryptoassets can be held through an exchange, mobile app, hardware wallet or self-custody wallet. The estate may be unable to recover them without the relevant wallet information, but putting a seed phrase in a normal document creates an unacceptable theft risk. Record that an asset exists, the service or device location, the ownership context and where the protected recovery information is held. Consider professional advice before anybody moves or sells anything.
HMRC's current Cryptoassets Manual says cryptoassets are treated as assets of an estate in much the same way as bank accounts, property, shares and investments, and that the date-of-death value should be provided when submitting an inheritance-tax return. HMRC's February 2026 Trusts and Estates Newsletter says to confirm cryptoassets on form IHT400, box 76, and add details in the Additional information section. It also suggests checking emails, bank statements, apps, devices and secure records when identifying holdings, and says inaccessible assets should be explained in the relevant estate information.
HMRC Cryptoassets Manual — Cryptoassets for individuals: Inheritance Tax →
HMRC — Trusts and Estates Newsletter, February 2026 →
Domains and websites can disappear quietly
A domain can expire while a family is dealing with more urgent matters. That can break email, a website, customer communications, login links and a business's credibility. Record the registrar and hosting providers, renewal dates, DNS and SSL arrangements, who owns the content and what should happen to the domain. A personal domain, a company domain and a client domain may need different decisions.
Business key-person risk is a digital legacy problem too
If one founder or administrator is the only person who can approve a payment, reset a tenant, access the domain, release a backup or administer a social page, the business has a continuity gap now, not only after a death. Put the organisation's access into a controlled admin process, use named accounts and role-based access, maintain break-glass procedures and document supplier contacts. Do not solve this by sharing one super-admin password.
Business companion: Could Your Business Keep Running If Its Owner Died Tomorrow? →
A five-minute starter plan
- 1Choose the person who should know where your plan is kept. This is a trusted coordinator, not automatically the person who should read your private messages or administer your estate.
- 2Write down your primary email address, phone number, password-manager provider, main cloud provider, social profiles, domains and any business administrator role. Write locations and actions, not passwords.
- 3Choose one action for each category: cancel, preserve or transfer/review. Start with the account that could lock everything else, usually your primary email or password manager.
- 4Set up the provider tools that match your wishes, such as Facebook Legacy Contact, Apple Legacy Contact or Google Inactive Account Manager, and keep their access instructions with the plan.
- 5Tell the executor or appropriate professional where the legal documents and the protected instructions are held. Ask them to use provider processes rather than trying to sign in as you.
The IT Club Digital Legacy Check
Use this quick check for a sensible first signal, not a legal score. Count how many statements are true. If any item marked with an asterisk is false, use the result shown below even if the total looks comfortable.
- I have a current inventory of email, devices, cloud storage, social accounts, subscriptions, domains and business access.
- My plan says whether each important item should be cancelled, preserved or transferred/reviewed.
- The person who needs to find the plan knows where it is, but the plan does not contain passwords, PINs or recovery secrets.
- My will or other legal documents and the secure access arrangement point to each other without duplicating secrets.
- My password manager has a tested emergency-access or trusted-contact route.
- I have a separate plan for phones, MFA, passkeys and recovery codes.
- I have recorded cryptoasset locations and ownership context without putting seed phrases in a normal document.
- I have configured any provider legacy or inactivity tools that fit my wishes.
- My domains, websites, business admin roles and renewal dates are not known only to me.
- I will review this plan annually and after major changes.
| Result | Use this interpretation |
|---|---|
| GOOD FOUNDATION | Most foundations are in place. Test the actual provider and emergency-access routes, then put the next review date in your calendar. |
| SOME GAPS | You have a useful start, but one or more categories could strand data, money or access. Fix the starred or highest-impact gap first. |
| NEEDS ATTENTION | The plan is likely to fail under pressure. Start with the primary email, password manager, MFA and legal-authority route, then work through the inventory. |
For a simple rule of thumb: GOOD FOUNDATION means eight or more checks are true and no starred control is missing; SOME GAPS means five to seven are true or a high-impact control is incomplete; NEEDS ATTENTION means four or fewer are true. These labels are deliberately limited to the three outcomes above.
Related reading
Check which apps can access your Google or Microsoft account →
What is a cloud service? A practical security guide →
Website backups and recovery: the plan your business needs →
Change Microsoft 365 provider without losing tenant control →
Download: My Digital Legacy Plan — one-page printable worksheet →
The annual Operational Heartbeat
A digital legacy plan decays like any other operational document. Once a year, spend 20 minutes checking that the inventory, people, devices and provider instructions still match reality. This is the Operational Heartbeat for your digital life.
- Remove old email addresses, devices, apps, domains and subscriptions; add anything new.
- Check that the named trusted person, executor and business contact are still appropriate.
- Test password-manager emergency access using the provider's safe test process, without handing over the vault.
- Check that MFA, passkeys, recovery contacts and backup codes are current, and that no important route depends on one lost phone.
- Review Facebook, Apple and Google legacy or inactivity settings, and re-read Microsoft guidance for the account type involved.
- Confirm photos and important files have a second copy and that its location is recorded.
- Review cryptoasset, domain and business-admin records after any transaction, new wallet, registrar change or staffing change.
- Record the review date and the next action. A plan nobody revisits is only a snapshot of an old life.
Frequently asked questions
Can my executor just use my passwords?
Not automatically. A password may provide technical access, but it does not settle whether the person is entitled to use the account, whether the terms allow it or whether the account contains somebody else's data. Give the executor a secure route to the plan and encourage them to use the provider's bereavement, legacy or legal process.
Should I put passwords in my will?
No. Keep the will focused on legal instructions and record where a protected password-manager arrangement or sealed instruction is held. Do not record passwords, PINs, MFA codes, recovery keys or crypto seed phrases in the one-page plan or the will.
Will Apple give my family access to my iPhone?
Apple Legacy Contact can provide a route to request certain Apple Account data when the access key and required documentation are available. It is not a promise that every service or a passcode-locked device can be opened. Apple says a device passcode lock may have to be removed by erasing the device.
Can my family read my Gmail or Outlook inbox?
Do not assume so. Google and Microsoft each describe provider-specific routes, and neither should be treated as a general password-recovery service for relatives. Microsoft says a personal account without access is closed automatically after two years of inactivity; that is not a promise of mailbox access. Your plan should explain the purpose of the inbox and the location of relevant records, while the authorised person follows the current provider and legal process.
What happens to cryptoassets when I die?
They may form part of the estate, but identification and access depend on whether they are held by an exchange or in self-custody. Record their existence, location and ownership context securely, and get appropriate tax or legal advice. Never put a wallet recovery phrase in an ordinary document or send it by email.
What if I run a business?
Treat administrator access, domains, email, finance systems, backups, customer data and licences as business-continuity controls. Use named accounts, more than one appropriately authorised administrator and a documented offboarding or emergency process. A business should not depend on one person's personal login.
Sources and further reading
Primary sources were checked on 28 August 2026. Provider features, account terms, tax guidance and legal processes can change. This article is general information, not legal, tax or financial advice.
GOV.UK — Applying for probate: overview →
GOV.UK — Dealing with the estate of someone who's died →
Plain-English Takeaway
The safest digital legacy plan is not a password list. It is a clear map of what exists, what should happen to it, who has lawful authority, and how the right people can act without bypassing security controls.
Tap to follow The IT Club Briefing on WhatsApp.
Related Articles
Why Office Printers Still Waste So Much Staff Time
Recurring printer problems rarely come from the printer alone. They come from the wider print environment — drivers, queues, network configuration and deployment. Windows printing is also changing, and businesses should understand what that means.
Read articleHow to Copy Text from Videos, Presentations and Images with Google Lens
Text on a paused video, a presentation slide, a screenshot or a photograph cannot normally be selected with the mouse. Google Lens can recognise visible text in an image and copy it to the clipboard — but OCR makes estimates, not photographs, and the result must always be checked before business use.
Read articleIs AI Saving Your Staff Time—or Creating More Admin?
AI can reduce the time required for individual tasks while creating additional work around them — particularly when tools, data and approval processes remain disconnected. Research from Workday found that one in four UK workers spends seven or more hours each week manually managing disconnected systems. This article explains why faster tasks do not always produce a faster business and what to measure to find out whether AI is genuinely helping.
Read article