Digital Assets After a Business Owner Dies: Email, Software, and Data Access

Why Digital Access Becomes an Emergency

When a business owner dies, the family or executor often discovers within hours that they cannot log into anything. The business email account holds vendor contracts, client correspondence, and login credentials for dozens of other platforms. The accounting software contains payroll records, outstanding invoices, and tax data. The domain registrar controls the company website. And every one of these systems requires a password nobody else has.

Unlike physical assets that sit in a filing cabinet waiting to be inventoried, digital accounts can be locked, suspended, or deleted by service providers who detect account inactivity. Google Workspace does not automatically convert to consumer accounts after non-payment; if the subscription is canceled and data is not preserved or exported, Workspace data can become inaccessible or be deleted.

What RUFADAA Means for Business Executors

The Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) has been adopted in some form by 49 states, the District of Columbia, and the U.S. Virgin Islands. It establishes a legal framework for fiduciary access to digital assets after someone dies.

Under RUFADAA, access follows a three-tier priority system:

1. The user's own instructions through an online tool (like Google's Inactive Account Manager or Facebook's Legacy Contact) override everything else
2. A will, trust, or other record that specifically addresses digital assets comes second
3. The service provider's terms of service apply only when the first two tiers are silent

Where RUFADAA applies to an account the deceased personally owned, a fiduciary may be entitled to the catalogue of electronic communications — information identifying communication participants, dates, and addresses — and other digital assets to the extent authorized. Employer-owned digital assets used by employees in the ordinary course of business may be excluded from RUFADAA; entity authority and service-provider terms then matter. RUFADAA distinguishes the catalogue from the content of communications. Accessing the actual text of emails or direct messages typically requires the user's consent or a court order.

The practical takeaway: if the deceased business owner's will or trust does not mention digital assets by name, the executor may need to petition the court for expanded access, which adds weeks to the timeline.

How to Actually Access Business Accounts

Start with the business computer itself. If the device is unlocked or the password is written somewhere (check the office, the deceased's phone notes, or a password manager), that single access point opens most other accounts through saved browser sessions.

If the computer is locked, a professional IT forensics firm or the company's managed service provider (MSP) can create a forensic image of the hard drive, but will need proof that the requester is authorized to access the company's data.

For cloud-based accounts specifically:

• Google Workspace: A super admin can manage user accounts and services, including resetting other users' passwords. If the deceased was the only super admin, use Google's admin-recovery process, which can require proof of domain ownership; the deceased-user process for personal Google accounts is separate
• Microsoft 365: A global admin can reset passwords for other users. If the deceased held the only global admin role, use Microsoft's tenant-recovery or business-support process; Microsoft's deceased-user guidance concerns personal accounts, where a valid subpoena or court order may be required to consider releasing account information
• QuickBooks Online / Xero: Contact support to confirm what proof of entity or legal authority is required for an authorized administrator or representative to access or export company data
• Banking portals: A deceased person's individual account may be frozen after the bank is notified. A corporation or LLC's account belongs to the entity, but the bank may restrict access if the deceased was the only authorized signer until a replacement signer is verified
• Social media and review profiles: Google Business Profile, Yelp, and LinkedIn company pages can be claimed or memorialized through their respective support channels with proof of death and legal authority

Protecting Business Value While You Wait for Legal Authority

The gap between the owner's death and the issuance of Letters Testamentary — often 30 to 90 days, depending on state law and the case — is when digital assets are most vulnerable. During this period:

Do not cancel any subscriptions or services. Domain registrations that lapse can be grabbed by squatters. Software subscriptions that expire may delete stored data. Email services that go unpaid will bounce incoming messages from clients.

Change passwords only if you have legal authority to do so, or if you are an existing authorized user on the account. Unauthorized access, even by well-meaning family members, can create legal complications under the Computer Fraud and Abuse Act.

Document everything. Screenshot account dashboards, export data where possible, and create an inventory of every digital service the business uses. This inventory can help identify digital assets for the formal estate inventory.

Planning Ahead: The Digital Estate Plan Every Business Owner Needs

If you are a business owner reading this proactively, the single most effective step is adding a digital assets clause to your estate planning documents. Name a digital executor (it can be the same person as your general executor), list your critical business accounts, and specify whether you want the executor to have access to the content of communications — not just the catalogue.

Store credentials in an encrypted password manager and share the master password with your designated executor through a secure method — a sealed envelope with your attorney, a dead man's switch service, or a shared vault in the password manager itself.

For businesses with employees, ensure that at least two people hold admin-level access to every critical system. Single points of failure in digital access are just as dangerous as single points of failure in operations.

The Small Business Owner Dies guide includes a complete digital asset inventory worksheet and step-by-step instructions for securing every type of business account in the immediate aftermath.