Post-mortem data is personal information that remains sensitive after a person’s death. It can include medical records, identity data, communications, financial details, and documents such as wills or advance directives. In cybersecurity and privacy work, the key point is that death does not automatically make data public or low risk.
This matters because attackers may still target deceased people’s records for fraud, impersonation, insurance abuse, extortion, or family phishing. Defenders should treat these records like other high-value personal data: apply role-based access control, minimize unnecessary sharing, log access, and use retention and deletion rules that match legal obligations. In healthcare, legal, and cloud systems, post-mortem data often requires the same protections as living-person data, plus careful handling of who is allowed to see or request it.