Digital succession and business continuity: how to protect assets, data and operations after the death of partners and managers

The digital transformation has caused a significant portion of the value of many companies to exist in virtual environments. Domains, email accounts, commercial profiles, monetized channels, cryptocurrency wallets, cloud systems, code repositories, software licenses, databases and administrative credentials can be essential for revenue generation and operational continuity. When a partner, founder or manager dies, the absence of clear rules governing these resources can paralyze activities, destroy economic value and intensify conflicts among heirs, other partners, clients and digital platforms.

In this context, digital succession has ceased to be a matter confined to private life. For business owners and managers, it must be addressed as a topic of corporate governance, business continuity, data protection and estate planning. The legal challenge lies in reconciling the transfer of assets with the deceased's right to privacy, the confidentiality of communications, third-party rights and the contracts entered into with technology providers.

Companies also leave a digital estate

A digital estate may encompass assets of a patrimonial, existential or hybrid nature. Patrimonial assets are those with identifiable economic value, such as cryptocurrencies, platform credits, intellectual property rights, domain names, commercial files and monetized accounts. Existential assets are content linked to personality rights, such as private messages, personal photographs and intimate records. Hybrid assets combine both dimensions, a situation frequently encountered in the profiles of founders, influencers and professionals whose personal image is intertwined with their brand and business activity.

This classification is decisive because not all content accessible via a password can be transferred in the same manner. An heir may be entitled to the economic value of a given asset without receiving unrestricted access to the private communications held within the same account. It is also necessary to distinguish between ownership of the content, the licence of use granted by the platform, rights over the data and the mere technical ability to access the system.

The current legal framework

Article 1,784 of the Brazilian Civil Code establishes the principle of saisine, under which the estate is transmitted to the heirs at the moment of death. This legal transmission does not, however, automatically resolve technical access to digital assets, nor does it override personality rights, confidentiality obligations or contractual restrictions. The Marco Civil da Internet (Brazilian Internet Civil Rights Framework — Law No. 12,965/2014) protects the confidentiality of data and communications, while the LGPD (Lei Geral de Proteção de Dados — Brazil's General Data Protection Law, analogous to the GDPR) does not expressly govern the succession of data belonging to deceased persons. Nonetheless, the LGPD remains fully applicable when accounts and files contain data of living clients, employees, suppliers or other individuals.

In the corporate context, the principle of legal entity autonomy set out in Article 49-A of the Civil Code requires that the assets of the legal entity be kept separate from the personal property of its partners. In principle, a domain name, software or database belonging to the company does not form part of the founder's personal estate. What enters the probate inventory are the deceased's partnership interests or shares and any personal rights. The problem arises when corporate assets were informally contracted in the partner's name, paid for with a personal credit card or secured solely by the partner's personal phone and two-factor authentication.

The death of a partner must also be analysed in light of the articles of association. Article 1,028 of the Civil Code provides, as a default rule, for the liquidation of the deceased partner's interest, unless the articles of association provide otherwise, the company is dissolved or an agreement is reached with the heirs. Accordingly, clauses governing the admission of successors, the valuation of the deceased's interest (apuração de haveres — the calculation of the economic value of a departing or deceased partner's share), interim management, voting rights and the transfer of intellectual property must be aligned with the rules governing access to digital assets.

The business risk hidden in personal accounts

The greatest vulnerability often lies outside the legal documents. It is common for only the founder to hold the master password to the cloud provider, the private key to a digital wallet, access to the advertising dashboard, the administrator account on the marketplace or the repository containing the product's source code. In such cases, the transfer of partnership interests does not guarantee the resumption of operations. The company may find itself unable to issue invoices, pay suppliers, serve clients, renew a domain name or fulfil regulatory obligations.

Improvised access by family members or employees also carries risks. Using the deceased's credentials without authorisation may violate terms of service, expose private conversations, compromise evidence, trigger a security incident and disclose personal data belonging to third parties. The appropriate corporate response is not to share passwords indiscriminately, but to establish an institutional architecture for access, recovery and auditing, with clear segregation between corporate and personal content.

The guidance of Brazil's Superior Court of Justice (STJ) on the digital estate administrator

In REsp 2,124,424 (Special Appeal — a form of cassation appeal before the STJ, Brazil's Superior Court of Justice), decided by the Third Panel of the STJ in September 2025, the majority recognised the need for a controlled procedure to examine the digital files of a deceased person. The adopted solution provides for the involvement of a specialised professional bound by a duty of confidentiality, tasked with identifying and classifying the content, with the court deciding what is patrimonial in nature and may be transferred and what must remain protected on grounds of privacy or personality rights.

Although the case arose from a family dispute, its reasoning is relevant to businesses. The decision signals that the law of succession does not authorise the indiscriminate opening of devices and accounts. In situations involving a mixture of corporate and personal files, the preservation of evidence, the restriction of access and judicial supervision may be indispensable. From a risk management perspective, this underscores the importance of keeping corporate assets in institutional environments, with documented ownership and audit trails.

Reform of the Civil Code and regulatory trends

Bill No. 4 of 2025, which proposes a broad overhaul of the Civil Code, introduces a specific chapter on Digital Civil Law and remained under consideration in the Senate as of July 2026. The proposal seeks to define digital patrimony, regulate the disposition of accounts and content and differentiate economically valuable assets from situations protected by privacy and communications confidentiality. Since the text may still be amended, companies should not wait for the reform to organise their governance.

The regulatory trend points towards greater precision in identifying account holders, documenting intent and establishing post-mortem access procedures. The liability of platforms for providing transparent mechanisms for memorialisation, deletion, limited transfer and data preservation is also expected to grow. For business groups operating across multiple jurisdictions, contracts with foreign providers may still involve rules on jurisdiction, data localisation and international legal cooperation.

Digital estate planning as a governance matter

A sound corporate estate plan must begin with an inventory of digital assets and confirmation of their legal ownership. The next step is to classify what is corporate, personal or hybrid in nature, to document the intellectual property chain of title, to review platform agreements and to establish continuity procedures. Critical accounts should use institutional email addresses, company-managed authentication, role-based access profiles, regular backups and secure recovery mechanisms.

Corporate and estate planning documents must be coordinated. Articles of association, shareholders' agreements, wills, gifts, family protocols and internal policies can define the succession of partnership interests, interim management and the disposition of assets. Credentials should not be disclosed in the will itself, which may become accessible during probate proceedings. It is safer to indicate the existence and location of a digital vault or protected instructions, with rules governing release and access logging. An ordinary power of attorney is, as a general rule, extinguished upon death and does not substitute for estate planning.

Criteria for the economic valuation and tax treatment of assets should also be established, including for probate and ITCMD (Imposto sobre Transmissão Causa Mortis e Doação — a Brazilian state-level inheritance and gift tax) purposes, in accordance with the applicable state legislation. Cryptocurrencies, intellectual property rights, platform revenues and assets held abroad may require expert reports and conflict-of-laws analysis. From a privacy standpoint, access must comply with the principles of necessity, purpose limitation, security and accountability, particularly where third-party data is involved.

Digital succession is today a concrete component of business continuity. The absence of planning can cause a legally sound company to lose access to the resources underpinning its operations, while excessive access can violate privacy, confidentiality and personality rights. The safest approach is to integrate succession law, corporate law, data protection, intellectual property and information security into a single strategy.

For business owners and managers, the most efficient course of action is to act before the succession event occurs, separating personal and corporate assets, formalising ownership and establishing contingency procedures. In light of existing legislative gaps and evolving case law, preventive legal counsel can help transform dispersed digital assets into a governance framework capable of preserving value, reducing conflicts and protecting business continuity.