Deceased Employee Digital Assets: What Employers Need to Know

The Two Categories of Digital Assets

When an employee dies, their digital footprint splits into two legally distinct categories: company-owned assets and personal digital property. Getting this distinction wrong can expose your organization to liability under the Computer Fraud and Abuse Act (CFAA), or leave critical business data locked behind credentials nobody else holds.

Company-owned assets include work email accounts on your domain, files stored on company servers or cloud platforms, CRM records, project management boards, and anything created on company hardware. Your organization has clear authority to access these through IT admin credentials — you don't need permission from the estate.

Personal digital property — the employee's personal email, social media accounts, personal cloud storage, and anything stored on personally-owned devices — is subject to different access rules under the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADA), adopted in most U.S. states. Even if you know the employee's password, logging into a personal account can violate the provider's terms of service and can constitute unauthorized access under the federal Computer Fraud and Abuse Act (CFAA).

How to Secure Company Digital Assets in the First 24 Hours

IT should execute these steps immediately after confirmed notification of death:

1. Suspend the employee's network credentials — disable Active Directory or SSO access, revoke VPN tokens, and deactivate building access cards tied to digital systems.
2. Redirect their work email — route incoming messages to their direct manager or a designated liaison. Pause any automated outbound campaigns, scheduled sends, or calendar invites.
3. Preserve their work files — create a forensic-grade backup of their workstation, cloud storage, and project repositories before anything gets archived or overwritten. This protects the company in case of an OSHA investigation or pending litigation.
4. Audit shared credentials — check whether the deceased used personal password managers for work accounts, shared logins, or served as the sole admin on any platform. Recovering these takes priority over routine tasks.

Don't wipe the workstation. Don't reassign the laptop. Preserve the device and its data while HR and legal check for any investigation, claim, or records-retention hold, and follow the organization's applicable retention requirements.

RUFADA and the Family's Right to Personal Digital Assets

Under RUFADA, an executor or personal representative can request access to a deceased person's digital accounts — but only under specific conditions. The hierarchy matters:

• First priority: Any online tool or legacy setting the deceased activated on the platform itself (Google's Inactive Account Manager, Facebook's Legacy Contact, Apple's Digital Legacy).
• Second priority: A written digital directive in the deceased's estate plan, explicitly authorizing fiduciary access.
• Third priority: Court-issued letters testamentary or administration, presented directly to the platform provider.

An employer or family member should not assume they have authority to access a personal account without an applicable authorization route. Using a stored password can violate the provider's terms of service and can constitute unauthorized access under the CFAA.

For employers, this means: if the deceased employee's personal laptop, phone, or accounts contain company data (common with BYOD policies), you'll need to work with the estate's legal representative to recover it. You cannot simply take their personal device and log in.

Company Laptops and BYOD Devices

Company-issued laptops are straightforward — they belong to the organization. Coordinate with the family liaison to retrieve them at a pace the family can manage, but the legal ownership isn't in question. Before reissuing the device, have IT create a complete disk image and check for any personal files the employee may have stored (family photos, personal documents). Transfer these to the estate.

BYOD devices are more complicated. The employee may have company email, Slack, and proprietary files on a personal phone or tablet. Your acceptable use policy should already address this scenario. If it does, follow the documented procedure for remote wipe of company partitions. If it doesn't — and many policies are silent on death — work with the estate representative and your legal team before taking any action on the device.

Social Media Accounts and Online Presence

If the deceased managed company social media accounts (LinkedIn company page, corporate Twitter/X), transfer admin access through the platform's business management tools. This is a company asset and doesn't require estate involvement.

Their personal social media profiles — LinkedIn personal page, Facebook, Instagram — belong to their estate. Most platforms offer memorialization options:

• Facebook/Meta: Allows a legacy contact to manage the memorialized profile, or the estate can request account deletion.
• LinkedIn: Accepts removal requests from verified family members.
• Google: Inactive Account Manager can auto-share data or delete the account after a set period.

The employer's role here is limited: inform the family liaison that these options exist, and provide any work-related content from the accounts that the company needs (screenshots of client conversations, campaign data) before the profiles are memorialized or removed.

Protecting Your Organization Going Forward

The best time to address digital asset succession is before a death occurs. Review your IT offboarding procedures to ensure they include a death-specific protocol — standard resignation checklists don't account for the emotional sensitivity or legal complexity involved.

If your organization is navigating this situation right now, the When Your Employee or Colleague Dies toolkit includes a complete digital asset transition checklist, step-by-step RUFADA compliance guidance, and scripts for coordinating with the estate on device recovery.