1This Regulation does not apply to the personal data of deceased persons. 2Member States may provide for rules regarding the processing of personal data of deceased persons.
Title is an unofficial description, added for readability.
GDPR’s scope ends at death — with conditions attached
No. GDPR Recital 27 excludes the personal data of deceased persons from the Regulation’s scope entirely. National law may still apply, and data revealing information about a living relative remains protected.
The exception hiding inside this recital
Recital 27 sounds absolute, but it only removes the deceased person’s own data protection rights. It doesn’t touch data that happens to be about them but reveals something about someone still living.
When a “deceased person’s” data is still protected
Genetic and family medical history are the clearest case: a deceased parent’s genetic test result is also information about their children. Joint financial records, shared correspondence, and family photos can raise the same issue. In these situations, GDPR applies — not because of the deceased person, but because a living data subject’s data is mixed in. Recital 158 flags the same boundary for archived records held in the public interest.
What this means in practice
GDPR still applies — to the living relative’s data
Check national law status below, plus any non-GDPR retention or confidentiality duties
Don’t treat “GDPR doesn’t apply” as “delete everything” or “keep everything” by default. Check three things before acting:
- Does national law (see below) impose its own deceased-persons rules?
- Does the record contain data about a living relative?
- Do other obligations still apply — tax/accounting retention, confidentiality duties, sector rules (e.g. health records)?
A GDPR subject access request doesn’t transfer to you when someone dies — the right was personal to them and doesn’t survive death under the Regulation itself.
- Some Member States give relatives or executors a separate national-law route — check the country below.
- Public-sector records may be reachable through freedom-of-information mechanisms instead.
- Probate and inheritance law may cover access to financial or contractual records regardless of GDPR.
National law status across the EEA
Recital 27 leaves the door open for Member States to legislate, and practice is genuinely split:
| Status | Countries |
|---|---|
| No additional national rules | Austria, Belgium, Croatia, Cyprus, Finland, Germany, Greece, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Romania |
| Additional rules in place | Varies by country — typically covering limited rights for relatives, executors, or specific sectors such as health records. Check local implementing legislation before relying on a GDPR-only analysis. |
Based on White & Case’s GDPR National Implementation Guide. Always confirm current status with local counsel, as national digital-legacy and post-mortem privacy laws are an active legislative area.
Frequently asked questions
Does GDPR protect a deceased person’s personal data?
No. Recital 27 removes deceased persons from GDPR’s scope entirely — the Regulation only protects identified or identifiable natural persons, and a deceased person is no longer considered a natural person for this purpose. Any protection has to come from national law or another legal basis instead.
Can I still request a deceased relative’s data under GDPR?
Not under GDPR’s own access right — that right was personal to the deceased and doesn’t pass to relatives or executors. Some countries provide a separate national-law route for this; others don’t. Public-sector data may also be reachable through freedom-of-information channels.
If GDPR doesn’t apply, can a company just delete or keep the data as it likes?
No. Other obligations typically survive independently of GDPR: statutory retention periods for tax and accounting, professional confidentiality duties, sector-specific rules such as health-record retention, and any national deceased-persons legislation. GDPR stepping back doesn’t create a legal vacuum.
Does GDPR Recital 27 apply to genetic or health data about a deceased relative?
Not fully. Genetic and health data about a deceased person often also reveals information about living relatives, such as inherited conditions. Where that’s the case, GDPR still applies to protect the living relative’s data, even though the deceased person’s own rights have ended.
Handling a real case, not just the theory?
National rules, living-relative data, and retention duties can all apply at once when someone dies. A DPO can walk through the specifics with you rather than leave you to piece it together from a recital.
Related provisions
Sources & further reading
- Regulation (EU) 2016/679 (GDPR), Recital 27 — official consolidated text
- Article 29 Working Party, Opinion 4/2007 on the concept of personal data (WP136) — basis for excluding deceased persons from “natural person” scope
- White & Case, GDPR Guide to National Implementation — country-by-country status of deceased-persons data rules