How to Create a Digital Will That Protects Your Online Privacy

A will used to deal with property and money may say very little about your online life. Yet your email account, cloud storage, social profiles, password manager, private messages, cryptocurrency and browsing history can reveal more about you than the contents of your home. When you die, those accounts do not automatically disappear, and your family may not know which services contain sensitive information.

A digital will is a set of instructions for handling your online accounts and digital assets after your death or if you lose the capacity to manage them. It can identify a trusted digital executor, explain what should be deleted, and separate financial records from personal material. It should also limit the amount of information that relatives, lawyers or service providers can access.

Australian users have extra complications to consider. Access to myGov, Medicare records, banking apps and superannuation information involves different organisations, contracts and legal rules. A thoughtful plan can reduce identity theft, prevent unnecessary exposure of private correspondence and make a difficult period less chaotic for the people left behind.

Map Your Digital Footprint

Start by making a private inventory of the places where your data lives. Include email addresses, social media, messaging apps, photo libraries, cloud drives, online shopping accounts, streaming services, dating profiles, forums, domain registrations and websites. Add devices such as phones, laptops, tablets, external drives and smart-home systems. A forgotten old email address may still be connected to password resets for important accounts.

Separate accounts by purpose rather than treating them as one large list. Financial accounts include online banking, share-trading platforms, PayPal, cryptocurrency exchanges and payment wallets. Personal accounts might contain medical documents, family photographs or intimate conversations. Work and community accounts may belong to an employer, club or volunteer organisation and should usually be handed back rather than passed to relatives.

Australian government services deserve their own category. A myGov login can provide a pathway to linked services such as the Australian Taxation Office, Medicare and Centrelink. It should not simply be written into an ordinary document alongside a password. Record that the account exists, explain who should be notified, and leave instructions for the authorised process rather than encouraging someone to bypass access controls.

Your inventory should also cover data held by other people. A family member may have tagged photographs of you, a friend may hold private messages, and a small business may retain customer records connected with your work. If you run a side business, keep track of website hosting, domain names, mailing lists, analytics accounts and customer databases. Privacy obligations may continue after your death, especially where other people’s personal information is involved.

Choose A Privacy-Minded Digital Executor

A digital executor is the person who carries out your instructions for online accounts. This may be the same person as the executor named in your will, but it does not have to be. The best choice is someone reliable, discreet and comfortable with technology, rather than simply the closest relative. They should understand that their role is to follow your instructions, not browse through every file they can open.

You can appoint different people for different responsibilities. One person might deal with bank and tax records, another with family photographs, and a third with a business website. Keeping the roles narrow can protect privacy. It also reduces the risk that one person receives unrestricted access to highly sensitive material, including health records, private correspondence or confidential documents belonging to others.

Write a short statement about your privacy preferences. It might say that personal messages should be deleted unread, that photographs may be copied to named relatives, or that all social media profiles should be memorialised or closed. You can specify that a digital executor must not publish private material, contact people from your accounts or use your identity after death.

Service providers set their own rules, and a will cannot guarantee access to every platform. Some accounts are licensed to a single person and may be closed when the account holder dies. Others offer legacy contacts, inactive-account settings or formal requests from an executor. Your instructions should therefore tell the executor what outcome you want while allowing them to use the provider’s lawful process.

Keep Access Details Separate And Secure

Do not put a master password, recovery codes and a complete account list in an ordinary will. Wills can become accessible through probate, and copies may be stored by solicitors, courts or family members. A public or widely circulated document containing credentials could become a permanent map of your identity.

Instead, store access information in a reputable password manager, an encrypted digital vault or a sealed document kept in a secure location. Your will can state where that material is held and who may retrieve it. If you use a password manager, check whether it supports emergency access, trusted contacts or a nominated beneficiary. Test the recovery process while you are alive; an arrangement that looks secure but cannot be used is of little value.

Two-factor authentication needs special attention. If your codes arrive by SMS, your executor may need access to your phone number, but transferring a number can create security risks. If you use an authenticator app or hardware security key, record where the backup codes and spare devices are stored. Do not leave a key hidden somewhere so obscure that nobody can find it, and do not keep all recovery methods in the same unlocked drawer.

Your plan should explain how devices are to be handled. A phone may contain years of location history, private photographs, health information and authentication tokens. Give instructions for backing up selected files before a device is wiped, and state whether the device should be destroyed, recycled, sold or given to someone else. A factory reset is important, but it is not a substitute for removing accounts, eSIM access and remote-login sessions.

Decide What Should Be Deleted

Privacy after death is partly a question of data minimisation. Make an explicit decision about old emails, browser histories, cloud backups, direct messages and unused accounts. Some information may help family members, settle an estate or demonstrate ownership. Other material may expose people who expected confidentiality. Leaving everything untouched can create harm long after the practical need for the data has ended.

Create categories such as preserve, transfer, archive and delete. Preserve legal, tax, insurance and property records for the period required by law. Transfer family photographs, creative work or business assets to named people. Archive information needed to manage an estate in an encrypted location. Delete advertising profiles, abandoned accounts, private conversations and duplicate files that have no continuing purpose.

Think carefully about social media. A public memorial page can comfort some families, while others prefer a quiet deletion. Give instructions for Facebook, Instagram, LinkedIn, X and any smaller community platforms you use. If you publish essays, videos or photographs, explain whether your intellectual property should remain online, move to an archive or be licensed to someone else.

The same principle applies to data brokers and advertising systems. You may want your executor to close accounts and request deletion where available, but they should not spend months trying to erase every trace of you. In Australia, privacy rights and deletion practices depend on the organisation, the type of information and the Privacy Act framework overseen by the Office of the Australian Information Commissioner. Record priority services first, and avoid promising a total digital disappearance.

Modern surveillance also makes deletion decisions harder. Facial recognition, location records and identity checks can be copied across systems outside your direct control; the expansion of such monitoring is explored in airport surveillance. Your digital will cannot erase every historical record, but it can prevent your executor from unnecessarily creating new exposure by continuing to use your accounts.

Make The Plan Legally Usable

A digital legacy plan should sit alongside a valid will, enduring power of attorney and relevant account nominations. These documents do different jobs. A will generally operates after death, while an enduring power of attorney can help if illness or injury leaves you unable to manage your affairs. Do not assume that naming someone in one document automatically gives them authority under another.

Australian succession law is administered through the states and territories, so requirements differ between, for example, New South Wales, Victoria and Queensland. Witnessing rules, executor powers and probate procedures should be checked with a qualified Australian solicitor or state trustee service. A note in a password manager is useful guidance, but it may not legally transfer ownership of a domain, cryptocurrency, copyright or other digital asset.

Review beneficiary nominations separately. Superannuation death benefits are generally dealt with through the super fund’s rules and beneficiary arrangements rather than simply through the wording of a will. Life insurance, managed investments and cryptocurrency platforms can also have their own procedures. Keep nomination records with the rest of your estate information and check them after marriage, separation, a new child or a major change in finances.

Write instructions in plain language. Say which person should act, where the inventory is kept, what must be deleted, and which records must be preserved. Avoid giving a relative permission to “handle everything online” when you mean only photographs and subscriptions. A clear scope protects both the executor and the people whose information appears in your accounts.

Review the plan every six or twelve months, and after a major change in technology or family circumstances. A good routine is to update your account inventory when you change phones, open a bank account or retire an email address. Treat the review as one of the practical privacy habits that keeps a wider personal security system working, rather than as paperwork completed once and forgotten.

A useful final document can be short: the names of your executors, the location of secure access details, account categories, deletion preferences, device instructions and professional contacts. Keep a dated copy in a safe place and tell the relevant people that it exists without revealing the credentials themselves.

The most protective approach is to minimise what survives, restrict who can access what remains and give each account a lawful path to closure. Create the inventory, secure the keys separately, connect the plan to your Australian estate documents, and schedule a review before the list becomes out of date.