Weekly Legal Review Archive
Weekly BriefingIssue #219 June 2026

What Happens to Your Digital Property When You Are No Longer Here?

Executive Summary

Protecting Wealth, Property and Business Decisions

What Happens to Your Digital Property When You Are No Longer Here?

Your digital property may outlive you, but your family may never reach it. Crypto wallets, online accounts, business platforms, cloud files and digital income can be lost forever if no one knows they exist, where they are held, or who has authority to access them. Planning ahead is how you protect your family from confusion, loss and locked-away value.

One Password Can Shut Down a Business

Businesses that collect customer, employee or transaction data cannot treat passwords, emails, cloud accounts and payment platforms casually. If critical systems are controlled by one person or stored in personal accounts, the business risks data loss, breach exposure, operational disruption and regulatory scrutiny. Proper access controls, data protection policies, account ownership records and exit procedures are now part of responsible business compliance.

Your Customer Data Can Become a Legal Liability

Every phone number, email, ID copy, payment record, delivery detail or client file a business collects creates legal responsibility. If that data is stored casually, shared loosely or exposed through poor systems, the business may face complaints, regulatory action, loss of trust and reputational damage. Customer data is not just information. It is a legal obligation that must be collected, stored and protected properly.

"The law does not eliminate risk. It allocates it. Our role is to protect your interests."

Kago Mburu Advocates

Featured Analysis

Featured Insight

What Happens to Your Digital Property When You Are No Longer Here?

When most people think about property, they think about land, vehicles, bank accounts, shares, houses and documents kept safely in a file. But modern wealth is changing. A person may now own or control valuable assets that exist almost entirely online. These may include crypto wallets, mobile money records, email accounts, cloud documents, websites, domain names, social media pages, digital photographs, online businesses, payment platforms, software, customer databases and intellectual property.

This is digital property.

The difficulty is that many people do not treat digital property as property. They think of it as passwords, apps, files or things stored on a phone. That becomes a serious problem when a person dies, becomes incapacitated, loses access, or when a business dispute arises. The asset may still exist, but if nobody can identify it, access it lawfully, prove ownership or manage it, its value may be lost.

Digital property can have financial, personal, business or evidentiary value. For an individual, it may include photographs, emails, cloud storage, crypto assets, online investment accounts and important personal records. For a business, it may include a website, domain name, business email, accounting system, payment platform, client database, digital contracts and social media accounts. For a content creator, it may include monetized pages, videos, digital products, audience data and brand contracts.

Kenyan law does not yet treat digital property under one single law. Instead, the legal position depends on the nature of the asset. If the asset is personal data, then data protection obligations arise. If it is an email, message, payment confirmation or digital contract, the law on electronic records and evidence may apply. If it is crypto or another virtual asset, the emerging virtual asset regulatory framework becomes relevant. If it is software, photographs, designs or written content, intellectual property law may apply. If it belongs to a company, company law, contract law and employment agreements may determine ownership and control. If it belonged to a deceased person, succession law becomes important.

This is why classification matters. Before a digital asset can be protected, one must know what it is, who owns it, where it is held, who controls access and whether it can legally be transferred.

Succession law deals with the property of a deceased person. Digital property can form part of an estate, but it creates practical problems. Some digital assets may pass to beneficiaries, such as crypto assets, digital income, intellectual property, online business interests and domain names. Others may be limited by platform terms, privacy rules or technical access restrictions. A family may know that an asset exists but still be unable to recover it if passwords, private keys, recovery phrases or account details are lost.

A digital message, email, phone note or voice note is also not automatically a valid will. The safer approach is to prepare a proper will that expressly deals with digital property. The will should give legal authority, while a separate digital asset memorandum can give practical guidance on what exists, where it is held and how it should be handled. Sensitive passwords and recovery phrases should not be carelessly placed inside a will because the will may later be copied, filed or handled by several people.

Planning should begin while the owner is alive and in control. A person should prepare a digital asset inventory, separate personal assets from business assets, confirm ownership, secure access information carefully, and update their will to include digital property. Businesses should also document ownership and access to websites, domains, payment platforms, customer databases, emails and social media pages.

Digital property is already part of modern wealth. If it has value, list it. If it requires access, secure it. If it belongs to a business, document ownership. If it should benefit your family, include it in your estate plan.

Your digital property may outlive you. The real question is whether the people you leave behind will be able to find it, protect it and lawfully manage it.

This is why digital property should be planned for early. Unlike land, vehicles or bank accounts, some digital assets may not be visible from any public record or physical document. They may sit behind an email, password, private key, phone, cloud account or online platform. If no one knows they exist, they may be lost. If no one has authority to deal with them, they may create disputes. If access is not secured, valuable accounts, records, crypto assets, online income or business platforms may become unreachable.

Digital property should be identified, documented and included in estate planning so that your family, beneficiaries or business can lawfully access, preserve and transfer it when needed.

  • Digital property is now part of modern wealth.
  • Online assets can be lost if no one knows they exist.
  • Access is as important as ownership.
  • A phone note or email is not automatically a valid will.
  • Passwords and private keys should be secured, not exposed.
  • Plan early so your family can lawfully access and manage your digital assets.

Need help identifying, protecting or planning for your digital property? Speak to us before valuable online assets are lost, locked away or left in uncertainty.

Regulatory Pulse

KRA

KRA has reminded taxpayers to file their 2025 income tax returns by 30th June 2026. Businesses should also note the growing link between declared income, expenses and electronic tax records. From the 2026 year of income, declared income and expenses must be supported by valid eTIMS/TIMS electronic tax invoices.

ODPC

The Office of the Data Protection Commissioner has continued to emphasize stronger data protection controls, including coordinated action by Data Protection Officers to address cybersecurity and regulatory challenges. Businesses handling customer, employee or transaction data should review their privacy policies, access controls, breach response procedures and data storage practices before a complaint or enforcement issue arises.

CBK

CBK’s latest remittances household survey highlights the continued importance of diaspora inflows to Kenyan households and investments. For families and businesses receiving money from abroad, proper records, clear investment instructions and legal documentation remain critical. Remittances should not only move quickly; they should also be traceable, protected and tied to clear ownership.

SASRA

The continued digitization of land services and expansion of the Ardhisasa platform reflects the government's efforts to improve transparency and efficiency in land administration. Buyers, investors and property owners should familiarize themselves with digital land processes and ensure that title verification and transactions are conducted through the appropriate official channels whenever available.

Key Judicial Precedents

JLM Couture Inc. v Gutman, No. 21-2535, United States Court of Appeals for the Second Circuit, 2024

This case is a useful warning to any business that relies on social media pages, websites, domains, online shops, payment platforms or digital accounts without clearly documenting who owns and controls them. JLM Couture was a bridal fashion company. Hayley Paige Gutman was a designer whose name and personality became closely connected to the brand. Over time, Instagram and Pinterest accounts connected to the brand became commercially valuable. They were not just places for posting photos. They were marketing channels, customer engagement tools and part of the business identity. When the relationship between JLM and Gutman broke down, the parties ended up in court over who should control the social media accounts. JLM argued that the accounts were connected to the business and should be controlled by the company. Gutman argued that she had created and owned the accounts. The court treated the accounts as a form of property and looked at ordinary ownership principles: who originally owned the accounts and whether ownership had ever been properly transferred. The lesson is very practical. A business should not assume that it owns a digital asset simply because the asset is used for business. If the account was created by an employee, consultant, influencer, founder or director, and there is no clear written agreement, the business may struggle to prove ownership when the relationship ends. In the Kenyan context, the same problem can easily arise. A company may have its Instagram page managed by an employee, its domain registered by a developer, its website hosted under a consultant’s email, its WhatsApp Business account linked to one director’s phone, or its customer database stored in a personal cloud account. Everything may appear normal until there is resignation, death, conflict, non-payment or refusal to hand over access. At that point, the business may be forced to go to court seeking injunctions, access orders, preservation of digital records, handover of passwords, control of accounts, or damages. The dispute may involve contract law, intellectual property, employment obligations, company governance, data protection and electronic evidence. The practical message is simple: digital property must be protected before a dispute arises. Businesses should document ownership, access rights, administrator controls, handover obligations, intellectual property assignment and exit procedures for all important digital assets.

* Digital accounts must be treated as business property, not personal convenience. * A business can lose control of its online brand if access is informal. * Passwords alone do not prove ownership of digital property. * Employment and consultancy contracts should clearly cover digital assets. * Social media pages, domains and websites should be registered under business control. * A business may end up in court if digital ownership and handover duties are unclear.

Republic v Data Protection Commissioner; Hotel Waterbuck Limited (Ex parte Applicant); Siele (Interested Party) (Judicial Review E011 of 2024) [2025] KEHC 5801 (KLR)

The decision in Republic v Data Protection Commissioner; Hotel Waterbuck Limited (Exparte Applicant); Siele (Interested Party) is an important reminder that ordinary digital marketing can expose a business to serious data protection claims. The dispute arose after Hotel Waterbuck used the image of a former employee on its website for commercial promotion. The employee complained to the Office of the Data Protection Commissioner, arguing that his image had been used without proper consent. The ODPC found against the hotel and ordered compensation. The hotel then moved to the High Court by way of judicial review, challenging the ODPC’s determination. The High Court did not go into the full merits of whether consent had been properly obtained. Instead, the court struck out the application because the hotel had used the wrong procedure. Since the Data Protection Act provides an appeal route against decisions of the Data Commissioner, the court held that the hotel ought to have filed an appeal rather than judicial review. For businesses, the lesson is very practical. A photograph, video, testimonial, staff profile, customer image or social media post is not just marketing content. It may contain personal data. If a business uses a person’s image to promote its services, it should be able to prove that the person gave clear consent for that specific use. This is especially important for hotels, schools, hospitals, law firms, real estate companies, restaurants, gyms, salons, influencers, agencies and SMEs that use staff or customer images online. If consent is informal, unclear or undocumented, the business may face an ODPC complaint, compensation exposure, legal costs and reputational damage. The case also shows that once a data protection dispute reaches the ODPC, a business must take procedure seriously. If dissatisfied with the Commissioner’s decision, the correct legal route must be followed. Practical Impact Businesses should obtain clear consent before using images, videos or personal details for marketing and should keep proper records of that consent. The wider lesson is that digital marketing must now be supported by proper consent, record keeping and internal approval processes. What appears to be simple promotional content can become a regulated data protection issue if personal information is used carelessly.

* Images, videos and staff profiles used in marketing may amount to personal data. * Businesses should obtain clear consent before using a person’s image online. * Consent should be documented, not assumed from employment or past dealings. * Former employees can challenge continued use of their image after exit. * Poor data handling can lead to ODPC complaints, compensation exposure and legal costs. * If dissatisfied with an ODPC decision, a business must follow the correct appeal procedure.

Ceres Tech Limited v Office of the Data Protection Commissioner (Civil Appeal E166 of 2025) [2026] KEHC 6200 (KLR)

This case relates to businesses that operate through apps, online platforms, digital lending systems, payment records or customer databases. Technology may make business faster, but it also creates a trail that can be questioned by a customer, regulator or court. The dispute involved Ceres Tech Limited, a digital lending business, and a complaint before the Office of the Data Protection Commissioner. The complaint concerned the handling of personal data in relation to a loan that the complainant said he had not taken. The ODPC made an award against the company, but the High Court later set it aside and sent the matter back for fresh determination because of concerns around the process followed. The important lesson is not simply that the company got temporary relief in court. The deeper lesson is that once a business uses personal data to identify a customer, approve a transaction, issue a loan, send reminders, make demands or update records, that data must be accurate, lawfully obtained and properly handled. For many businesses, this feels far away until a complaint is made. A customer may say they never gave consent. A borrower may deny taking a loan. A person may complain that their phone number, ID details or contact information was used wrongly. An employee may challenge how their data was stored or shared. Suddenly, what looked like a simple digital transaction becomes a regulatory dispute. In the Kenyan context, this matters especially to digital lenders, fintechs, SACCOs, employers, schools, hospitals, online shops and SMEs that collect names, phone numbers, ID numbers, photos, payment records and customer files. If the business cannot show where the data came from, why it was used, who accessed it and whether the person was treated fairly, it becomes exposed. The case also reminds businesses that regulators must act fairly, but businesses must also keep proper records. Data protection compliance is not just a policy on a website. It is the ability to prove that your digital systems are lawful, accurate and accountable. Practical Impact Businesses should strengthen consent records, identity verification, customer communication controls, complaint handling and data protection procedures before a digital transaction becomes a court dispute.

* Digital businesses must be able to prove that customer data was lawfully collected, verified and used. * A disputed loan, payment record or customer account can quickly become an ODPC complaint and court matter. * Consent, identity verification and customer communication records should be properly documented. * Businesses using apps, lending platforms or customer databases must ensure their data processes are accurate and accountable. * Even where a regulator’s process is challenged, the business still needs strong records to defend its digital systems.

Practical Implications for Advisors

Need Legal Guidance?

We are here to help you navigate complex legal matters with clarity, strategy and excellence.

Land Law
Conveyancing
Commercial & Corporate
Dispute Resolution
Succession & Family Law
Employment Law
Notarial Services
Book a Consultationkagomburuadvocates.com/contact
WhatsApp0731 976 499
Emailinfo@kagomburuadvocates.com
Visit Our Websitekagomburuadvocates.com
LinkedInlinkedin.com/company/kago-mburu-advocates
TikTok@kagomburuadvocates

Strategic Implications for Your Matter

Does your property, transaction, or succession matter intersect with these findings? Request a private consultation.

Online uploads are limited to 10 PDF pages and 5MB per file. Larger bundles can be sent by email or WhatsApp.

For within a week matters — our team prioritises your request accordingly.