THE DEAD HAVE NO DATA: Posthumous Digital Dignity and the Silence of Indian Law

ABSTRACT

This article examines the legal vacuum surrounding posthumous digital dignity in India – the chasm between what the Digital Personal Data Protection Act 2023 nominally protects and what artificial intelligence-driven deepfake technology can do to those who are no longer alive to object. Through doctrinal analysis of Indian constitutional and statutory law, engagement with comparative frameworks across France, the European Union, and the United States, and close reading of the Rashmika Mandanna deepfake episode as a case study in the law’s failure of imagination, this article argues that India’s current legal architecture is structurally incapable of protecting the deceased from posthumous digital violations. It further contends that the DPDP Amendment process, with full regulatory compliance deferred to 2027, offers an active legislative window that India cannot afford to let pass.

INTRODUCTION

Imagine a school teacher from a small village in India. She attended a relative’s marriage some years ago, and her video was uploaded on a social media platform without her permission. Her voice and her face, preserved in a reel, sit on the servers she never thought to audit.

Years after her death, her video appears again. But this time, she is not at a wedding. She is laughing in a video she never filmed, speaking words she never said, in a context she would have found unconscionable. Her family sees it. They want to act. They open the law. And the law looks back at them with the quiet, terrible blankness of a bureaucracy that was simply not built to receive this kind of grief.

And unfortunately, this is not just a hypothetical designed to alarm. It is a description of a legal reality that India has not yet confronted, even as the technology that makes it possible has become widely accessible, cheaply available, and rapidly improving.

The country that in 2017 recognised the right to privacy as a fundamental right of every person[1] – a landmark judgment that linked privacy to the constitutional core of human dignity – is the same country that, through both judicial precedent and legislative silence, has confirmed that this right evaporates at the moment of death.

The Digital Personal Data Protection Act 2023[2], India’s first comprehensive data protection statute defines its protections around the ‘data principal’, meaning a living natural person.[3] The General Data Protection Regulation of the European Union is equally explicit that it does not apply to the deceased, but delegates to its member states the authority to fill that gap.[4] France exercised that authority in 2016.[5]

India’s DPDP Act contains no equivalent enabling mechanism. The Information Technology Act, 2000, the statute under which the Indian state has historically prosecuted digital privacy violations, was drafted in an era that had not conceived of deepfakes, AI-generated voice clones, or the commercial resurrection of a dead person’s likeness.[6]

This article argues three things. First, the existing Indian legal framework, constitutional, statutory, and tortious, is structurally incapable of protecting porsthumous digital dignity. Second, that this incapacity is not inevitable: comparative jurisdictions have demonstrated that posthumous data protection frameworks are both legally coherent and practically implementable. Third, the present moment, with DPDP Rules phased in through 2027, represents a legislative window that India should use, rather than wait for the first high-profile posthumous deepfake scandal to force its hand.

CONCEPTUALISING DIGITAL DIGNITY BEYOND THE LIVING

Death, in the analogue world, was relatively orderly. It was limited to the yellowed papers and faded photographs. Voices existed just in the memories of those who had loved them. However, the internet has no such mechanism. It does not decompose and lives even when a person ceases to exist. A person’s digital footprint: social media profiles, photographs, recorded speech, biometric data, behavioural patterns manifested in their algorithm and personalised ads over the years, survives them with perfect fidelity, available for retrieval, manipulation, and commercial use by anyone with the technical means and the inclination.

The concept of “digital dignity” is distinct from privacy, though the two are related. Privacy, in its pure form, protects a living person’s capacity to control the flow of data about themselves: who knows what, who processes it, and on what terms.

Dignity, on the other hand, operates differently. It concerns the integrity of a person’s identity and includes their image, voice, likeness, and the coherent narrative of a self. Dignity, unlike privacy, has never been understood as purely instrumental. It is not simply a means to enable autonomy; it is, in the language of the Puttaswamy judgment, ‘the constitutional core’ of the rights that the Constitution guarantees.

Natural rights theory, as articulated by scholars engaging posthumous personality rights, holds that dignity is inherent and timeless, not contingent on biological life.⁷

The question of whether dignity ‘survives’ death is not merely a philosophical abstraction; it is the doctrinal foundation on which any posthumous legal protection must rest. If dignity is understood as co-extensive with life, then the dead have no cognisable interest in how their identity is used. If dignity is understood as attaching to personhood in a broader sense, to the memory, the reputation, and the relational meaning a person carries into their community, then it cannot be simply extinguished by the stopping of a heart.

The emergence of generative artificial intelligence has made this question urgent in ways that the philosophers of natural rights did not initially anticipate. AI-powered deepfake technology can reconstruct a person’s face with photorealistic accuracy from a handful of photographs.

Voice cloning can reproduce speech patterns from thirty seconds of audio. Digital resurrection services now exist commercially that offer to recreate deceased individuals as interactive chatbots, capable of holding conversations with the bereaved.

In each case, the dead person’s identity is being used, manipulated, and monetised without their consent, and, in the current Indian framework, without any legal remedy for those who loved them.

III. THE CONSTITUTIONAL FOUNDATION AND ITS LIMITS

In August 2017, nine judges of the Supreme Court of India sat together and gave the country its right to privacy. They also, in the same breath, confirmed, with less emphasis than the occasion perhaps warranted, that this right ends at death.

Justice K.S. Puttaswamy (Retd.) v. Union of India is rightly celebrated as a transformative moment in Indian constitutional jurisprudence. The nine-judge bench unanimously held that the right to privacy is protected as a fundamental right under Article 21 of the Constitution, the right to life and personal liberty, as well as under the broader freedoms enshrined in Part III.

The judgment linked privacy to dignity in terms that were philosophically sophisticated and practically significant. Justice Chandrachud, writing for the majority, observed that ‘privacy is a concomitant of the right of the individual to exercise control over his or her personality.’ Justice Sapre, in his concurring opinion, went further: privacy, he wrote, “is born with the human being and extinguished with the human being.”

That phrase contains the entire problem this article addresses. It is not a careless observation. Justice Sapre was making a considered doctrinal point: that the right to privacy, as a fundamental right under Article 21, is a personal right, co-extensive with the life and liberty of the individual who holds it. When that individual dies, the right dies with them. This is consistent with the general structure of Part III of the Constitution,⁸ which confers rights on persons, not on estates, memories, or family members acting in the deceased’s interest.                                         

The constitutional gap is therefore structural, not incidental. Fundamental Rights under Part III of the Constitution do not apply to the dead, and a deceased person is not a legal person for most purposes. There is no constitutional mechanism by which a family member can assert, as a fundamental right, that their deceased relative’s image must not be used in an AI-generated pornographic video. This is not a gap that judicial interpretation alone can fill; the constitutional architecture makes it structurally resistant to such extension.

The constitutional understanding of dignity as an active, enforceable value was further deepened in Navtej Singh Johar v. Union of India, where the Supreme Court held that dignity is not a mere abstraction but a lived constitutional guarantee – one that the state is obligated to protect, not merely refrain from violating. Read alongside Puttaswamy, Johar confirms that dignity sits at the heart of Article 21. The question this article raises is why that commitment to dignity does not survive the death of the person who held it. ⁹

What the Constitution can do, and what Parliament has not yet asked it to do, is provide the foundation for comprehensive statutory protection. Dignity, after all, is not solely the province of the living. The interest in being remembered accurately, in not being commercially exploited after death, in not having one’s identity weaponised against one’s community – these are interests that the law is capable of recognising, if Parliament chooses to recognise them.

THE DPDP ACT 2023: A PARTIAL AND IMPERFECT ANSWER

The Digital Personal Data Protection Act 2023 arrived with considerable fanfare. It was India’s first comprehensive data protection legislation, the long-deferred legislative response to the Puttaswamy judgment, and the statutory realisation of a right that the Supreme Court had recognised six years earlier. It established a consent-based framework for the processing of digital personal data, created the Data Protection Board of India as an independent adjudicatory body, and granted data principals a suite of rights – to access, correction, erasure, and grievance redressal. It was, by any measure, a significant legislative achievement.

What it was not, and this is the burden of the present analysis, was a framework adequate to the challenge of posthumous digital dignity.

The Act’s definition of “data principal” is the critical fault line. A data principal is defined as “the individual to whom the personal data relates”. The use of “individual” is not accidental; it refers, throughout the Act, to a living natural person. Once that person dies, they cease to be a data principal. Their data does not cease to exist, but their standing under the Act does. The rights conferred – to access, to erasure, to grievance – are personal rights that cannot be exercised by the dead

The Act does provide, under Section 14, a nomination mechanism: a data principal may, during their lifetime, nominate another person to exercise their rights in the event of their death or incapacity. This is a meaningful provision, but it is a narrow one. It addresses the transmission of existing data rights, the right to access one’s data, to seek its erasure, rather than the emergence of new violations. A nominee can, in principle, seek the erasure of the deceased’s personal data from a platform’s servers.

However, a nominee cannot seek a remedy for the use of the deceased’s face in a deepfake video created after their death, using AI trained on data that may not have been in any database at the time of death.

Furthermore, the nomination mechanism is complicated by the law of succession. The Supreme Court’s decision in Shakti Yezdani v. Jayanand Jayant Salgaonkar¹⁰ established that being a nominee does not automatically entitle a person to inherit rights; nomination and inheritance are legally distinct.

Applied to the DPDP Act context, this creates an unresolved question: does a nominee exercise the deceased’s data rights as an agent of the estate, or in their own right? The Act does not say.

The DPDP Rules 2025, notified in November of that year, elaborate on operational mechanisms but do not resolve this ambiguity.

The deeper problem, however, is not technical. It is conceptual. The DPDP Act was designed to protect informational privacy, the right of a living person to control their data. It was not designed to protect posthumous dignity, the interest of a dead person (and their family and their community) in not having their identity degraded, commercialised, or weaponised after their death. These are related interests, but they are not the same interest, and a framework designed for one cannot, without amendment, serve the other.

DEEPFAKES AND THE AI PROBLEM: WHERE THE LAW GOES SILENT

In November 2023, Rashmika Mandanna’s face was placed on a body that was not hers, in a video she had never made, and distributed across social media platforms to millions of viewers.¹¹ She was alive to protest. She did protest publicly, and the Delhi Commission for Women intervened. The Delhi Police registered an FIR. The government issued advisories to social media platforms. The law responded, however, inefficiently.

The question this article asks is simpler and more disturbing: what if she had not been alive to protest? What if the same video had been made of a woman who had been dead for two years, whose photographs remained online, whose face could be extracted from a dozen uploaded images? Who would have stood to file the complaint, under which provision and under which forum?

The answers, under current Indian law, are: nobody is certain, no specific provision exists, and no forum has been established.

The Information Technology Act 2000, India’s primary instrument for prosecuting digital privacy violations, contains several provisions that are relevant to deepfakes. Section 66E punishes the intentional capturing, publishing, or transmission of images of the ‘private area’ of a person without their consent.

Section 66C addresses identity theft; Section 66D, cheating by personation. In the Mandanna case, the police invoked Sections 66C and 66E of the IT Act alongside Sections 465 and 469 of the Indian Penal Code¹² (now replaced by the Bharatiya Nyaya Sanhita, 2023), covering forgery and reputation-harming forgery respectively.

Each of these provisions, however, presupposes a living victim. Section 66E’s protection of the ‘private area’ of a ‘person’ is directed at living individuals; its consent framework assumes a person capable of giving or withholding consent. Section 66C’s identity theft provisions contemplate an “electronic signature, password, or any other unique identification feature of another person” that, while potentially broad enough to encompass a deceased person’s biometric likeness, has never been judicially interpreted in that context.

The absence of interpretive precedent is not an invitation to assume the provision applies; it is, rather, evidence of the law’s failure to anticipate the problem

India has no dedicated deepfake legislation. The government’s responses to the Mandanna incident, ministerial statements, and advisories to platforms were reactive rather than structural and addressed the living victim rather than the legal gap.

The European Union’s Artificial Intelligence Act, by contrast, imposes transparency obligations for AI-generated or manipulated content, including many deepfakes, requiring providers to disclose when content has been artificially generated or manipulated.¹¹ And India has no equivalent framework for the living or the dead.

The Mandanna case, for all its public visibility, was resolved through existing provisions applied creatively to a novel fact pattern. That is the kind of legal improvisation that works when a victim is alive, present, and able to navigate the system. It is exactly the kind of legal improvisation that fails when the victim is dead, and when there is no one with established standing, no provision that clearly applies, and no precedent to guide a court.

COMPARATIVE PERSPECTIVES: WHAT OTHER JURISDICTIONS HAVE DONE

France and the Loi pour une République Numérique

France is the most instructive comparator for India’s purposes, not because its legal system is closest to India’s, but because it moved earliest and most comprehensively. The Loi pour une République Numérique, enacted in October 2016, amended the French Data Protection Act to introduce what French law calls ‘directives post-mortem’: binding instructions that any individual may leave, during their lifetime, governing the retention, deletion, and communication of their personal data after their death.

Under Article 85 of the amended French Data Protection Act, a person may designate a trusted third party to carry out their data directives after death; in the absence of such a designation, heirs may exercise specified rights on behalf of the deceased. The Commission Nationale de

‘Informatique et des Libertés, France’s data protection authority, publishes guidance on the exercise of these rights and monitors compliance.¹³

France enacted this framework two years before the GDPR came into force, making it the first EU member state at the time to have specifically legislated on posthumous data protection. No contractual clause can limit the rights granted under Article 85, a provision that prevents platforms from burying posthumous data obligations in terms and conditions that no one reads.

The GDPR and the Limits of European Harmonisation

The GDPR’s position on the deceased is clear and, in context, somewhat surprisingly permissive of member state divergence. Recital 27 states, without qualification, that the Regulation does not apply to the personal data of deceased persons.1⁴ But the same recital permits member states to provide their own rules on the matter.

France exercised this permission through the Loi pour une République Numérique. Italy’s Codice in materia di protezione dei dati personali takes a broad approach, permitting ‘any interested party’ to exercise data rights in respect of a deceased person, a formulation that, whatever its interpretive challenges, at least recognises that posthumous data rights are cognisable interests.

India’s DPDP Act contains no equivalent enabling provision. It does not state, as the GDPR does, that it is silent on the deceased because it has left the matter to be addressed elsewhere. It is simply silent, which is to say, it treats the legal vacuum as a feature rather than a gap.

The United States: State-Level Innovation in the Absence of Federal Standards

The United States presents a patchwork that is instructive in its ambition even where it is incomplete in its reach. California’s Celebrities Rights Act and New York’s Right of Publicity

Act both extend the right of publicity, the right to control commercial use of one’s name, image, and likeness, beyond death.

California’s formulation is broader, covering any “deceased personality” and expressly including AI-generated replicas within its scope.¹⁵

New York’s statute is narrower, with greater space for expressive works and artistic exceptions, but its enactment of specific provisions governing AI deepfakes of deceased performers represents a recognition that existing law was inadequate to the technological reality.¹⁶

Academic scholarship has framed the problem with precision: posthumous deepfake cases raise both dignitary and property dimensions, with dignitary interests arising from a class of protections broadly concerned with protecting various dimensions of individual dignity or the values that comprise individual worth.¹⁷

The law’s challenge is to give these dignitary interests institutional expression, to translate the felt wrongness of posthumous deepfakes into enforceable legal standards.

This comparative trend reflects a broader concern identified in recent scholarship: posthumous deepfakes expose a doctrinal gap because existing privacy and publicity frameworks were not designed to address AI-generated digital replicas of deceased persons.¹⁸

Estonia

Estonia’s approach, though less discussed in comparative literature, merits attention. Its data protection framework adopts what has been described as an ‘IP-like model’, treating an individual’s right to control their personal data as akin to an intellectual property interest, transmissible and capable of being exercised by designated successors.

This framing of data control as a species of property right rather than purely a personal right offers a conceptual bridge between the living-person architecture of privacy law and the posthumous dimensions of dignity protection. It is a bridge that Indian law has not yet thought to build.¹⁹

VII. THE CASE FOR REFORM

Reform is not a dramatic ask. It is a modest, technically feasible, and politically achievable one. The DPDP Act’s Rules are still being phased in; full compliance is not required until May 2027. There is a legislative window, and it is open.

A posthumous digital dignity framework adequate to the present challenge would need to do three things.

First, it would need to extend the DPDP Act’s coverage to include posthumous data rights, with a defined temporal scope. France imposes no fixed time limit on posthumous data protection directives; a workable Indian starting point might be a period of twenty-five years from the date of death, subject to review. The mechanism could mirror the existing nomination provision under Section 14, expanded to confer substantive rights on nominees and legal heirs, not merely procedural ones. These rights should include the right to seek erasure of the deceased’s data from platforms, the right to object to further processing, and, crucially, the right to bring a complaint before the Data Protection Board in respect of posthumous dignity violations.

Second, it would need to address the specific problem of AI-generated deepfakes and digital resurrection.

The IT Act’s existing provisions are not adequate for this purpose; they were not designed for it, and their application to posthumous deepfakes is, at best, uncertain. A specific provision, whether in the DPDP Act, in a dedicated deepfake statute, or in an amendment to the IT Act, should prohibit the creation and distribution of AI-generated synthetic media that falsely depicts a deceased individual without prior consent (expressed during the individual’s lifetime) or the authorisation of a legal heir. Such a provision should carry civil remedies cognisable before the Data Protection Board, as well as criminal penalties where the depiction is obscene, defamatory, or commercially exploitative.

Third, the framework should codify standing for legal heirs and designated nominees to bring complaints and initiate proceedings in cases of posthumous dignity violations. The current absence of codified standing is one of the principal barriers to enforcement. A family member who discovers a deepfake of their deceased parent currently has no clear legal pathway.

The law should provide one, clearly, specifically, without requiring them to navigate the uncertainty of implied rights and creative statutory interpretation.

The framework should be accompanied by proportionate safeguards. Posthumous data protection must not become an instrument of historical sanitisation or a barrier to legitimate journalism, academic research, and artistic expression. The framework should include explicit exceptions for public interest research, journalistic reporting on matters of genuine public concern, and artistic works that engage critically with the lives of public figures, with the burden of establishing the exception resting on the party asserting it. These are well-established limitations in comparative data protection law, and their incorporation into an Indian framework would not be technically difficult.

VIII. CONCLUSION

The law is not indifferent to the dead. It buries them, certifies their deaths, settles their estates, administers their wills, inscribes their names on registers of mortality. It has, for centuries, found ways to give legal effect to the interests that the dead leave behind, in their property, their reputations, their final expressions of will.

What it has not done, in the age of artificial intelligence, is protect their faces and their voices. The versions of themselves that now live on, infinitely malleable, in servers they never consented to, processed by algorithms that extract pattern and personality from data they uploaded in moments of thoughtlessness or trust.

The Puttaswamy judgment told India that privacy is born with the person and extinguishes with them. That was a coherent position in 2017, when the dead were, in the main, safely dead -present only in photographs and memories and the occasional archived page. It is a less coherent position in 2026, when the dead can be made to speak, to perform, to endorse, to appear in contexts that degrade everything they were. The technology has moved, but the law has not.

India has a legislative window, and the comparative world has provided it with more than enough models to work from. France did it in 2016, before the GDPR made it fashionable. California did it because its entertainment industry understood, earlier than most, that death is not the end of a person’s commercial value – and that without legal protection, it is also not the end of their vulnerability. India’s silence on this question is not principled neutrality. It is an oversight that technology will continue to exploit until the law decides to notice.

That is the silence this article has attempted to name, in the hope that naming it clearly might be the first step toward answering it.

BIBLIOGRAPHY

Table of Cases

Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (India).

Navtej Singh Johar v. Union of India, (2018) 10 SCC 1 (India).

Shakti Yezdani & Ors. v. Jayanand Jayant Salgaonkar & Ors., 2023 INSC 1076 (India).

Table of Legislation

Constitution of India, 1950.

Digital Personal Data Protection Act, 2023 (India).

Information Technology Act, 2000 (India).

Indian Penal Code, 1860 (India).

Loi n° 2016-1321 du 7 octobre 2016 pour une République Numérique (France).

California Civil Code § 3344.1 (California Celebrities Rights Act) (U.S.).

New York Civil Rights Law §§ 50-f (Right of Publicity Act) (U.S.).

Secondary Sources

Business Today Desk, Rashmika Mandanna’s Deepfake Video: Delhi Police Register FIR in Case After DCW Seeks Action, TODAY (Nov. 11, 2023).

Sarah K. Coles, Deepfakes of the Dead: Applying Postmortem Publicity Law to Artificial Intelligence Digital Replicas, WAKE FOREST J. L. & POL’Y (Nov. 20, 2025).

Justin P’ng, The Resurrection Will Not Be Televised: Legal Remedies for Posthumous Deepfakes, GEORGETOWN L. TECH. REV. (May 2024).

Régis Chatellier, Post-Mortem Data: Is There a Digital Life After Death?, LINC (Feb. 3, 2025).

Singh A. & Mehta A., Posthumous Personality and Data Protection, IJCRT (2025).

GDPR Guide to National Implementation: Estonia, WHITE & CASE (2022).