When someone dies, the practical questions arrive almost at once, and they arrive at the same time as the grief. In a business, one of the first is often quiet and unexpected: who knew the password? A bookkeeper, an owner's partner, a long-serving office manager or a technician has died or is suddenly unavailable, and it becomes apparent that the bank profile, the payroll system, the accounting software and the email account were all in one person's hands. The people who are left must keep a business running while also dealing with a loss.
This piece looks at what a bereavement reveals about how access is held, why it matters for the people left behind and not only for the business, and how to prepare without making anyone uncomfortable. It is a hypothesis about a common pattern, written with care, and not a prediction about any particular business or family.
Why one person ends up holding the keys
Nobody plans for this. Access collects around individuals through ordinary convenience.
- The person who set it up keeps it. Whoever opened the online banking profile, registered the company with SARS eFiling or signed up for the payroll software becomes the login holder, often with their own email address or mobile number as the recovery route.
- Two-step verification follows the phone. Codes arrive on a personal handset. When that handset is locked, lost or inherited by a family member, the way back into the account is gone.
- Passwords are remembered, not recorded. A trusted employee who has handled the same systems for fifteen years may have no written record because none was ever needed.
- Personal and business overlap. A sole proprietor's business email, personal photographs and banking app may all live on the same device behind the same passcode.
Mellorca's work on automation understood by one employee and key-person dependency as a systems problem covers the general case. A death makes it irreversible in a way that a resignation does not, because the person cannot be rung and asked.
What the reference material says
No South African statistic on access lost after a death is cited, and none is claimed. The points below come from general references and from the law.
Reference material on digital inheritance describes the question of what happens to a person's online accounts, files and digital assets after they die, and notes that service providers' terms and the law of the relevant country often limit what survivors can do. The practical lesson is that access usually cannot be assumed to pass automatically to the family or the business.
General references on password managers describe them as programs that store credentials in an encrypted vault, protected by a master password. Some offer shared vaults or emergency-access features, so that a trusted person can be granted entry under defined conditions. That is a feature to look for, not a guarantee that any particular product will suit a given business.
South Africa's Protection of Personal Information Act places duties on organisations that hold personal information about employees, customers and suppliers. When access is lost, or is gained informally by guessing or borrowing a login, those duties do not pause. The Information Regulator's POPIA pages are a useful starting point, and a business should take advice before using a deceased person's credentials to enter systems that hold other people's data.
An illustrative case
Consider an illustrative example, not a real case: a small accounting practice in Cape Town run by two partners and a part-time administrator. One partner, Pieter, handles the firm's bank profile, payroll bureau and the SARS eFiling logins for several clients. He dies unexpectedly on a Sunday.
On the Monday, his partner and the administrator are grieving, and they are also facing salaries due on the 25th, a VAT submission for a client at month end and a bank that will not discuss the business account with anyone who is not a registered user. The authentication codes go to Pieter's phone, which is with his family. The administrator does not like asking his widow, and the partner does not know whether it is appropriate.
Nothing here is anyone's fault. But the family is asked to hand over a phone that holds private messages and photographs while they are making funeral arrangements, and the colleagues are put in the position of having to ask. What should have been a straightforward business continuity task becomes an emotional ordeal for everyone involved.
The human tax: safety, wellbeing and access
The first cost is to wellbeing. People in grief are asked to solve technical problems. A spouse may be contacted about a banking token. A junior employee may be asked to guess a password. Each request adds weight to what is already a painful time. The Mellorca article on the owner facing illness with no one who knows the systems describes a related case, and handing over an undocumented job shows the same gap in a planned absence.
The second is access itself. Staff may go unpaid, clients may miss deadlines, and suppliers may stop trusting the business, because a login was held by someone who can no longer give it. Safety also matters: the temptation to work around controls under pressure is real, and workarounds made in a crisis are rarely tidy. When access controls feel like distrust is worth reading alongside this, because the answer to this problem is not to remove controls but to design them for a world in which people are sometimes absent.
What could realistically change
The aim is gentle, practical preparation, done in calm weather, that spares families and colleagues from being asked impossible things later.
- List the critical access points. Banking, payroll, tax portals, accounting software, email, domain and cloud storage. For each, note who holds it and who could recover it.
- Use named business accounts. Wherever possible, register services to a business email address that more than one person can reach, and add a second authorised user with a defined role.
- Use a shared vault with emergency access. A business password manager lets credentials belong to the company, not a person.
- Keep a sealed continuity note. A short, locked document naming who to contact, where recovery details are kept and who may open it. Review it each year.
- Separate personal and business devices where you can. A business phone number for verification codes is easier to hand on than a private one.
- Talk about it once. A brief, honest conversation with partners and key staff about what would happen is far easier now than at a funeral.
The practical method is the same as for any handover: design it so that it cannot depend on memory.
The business outcome
The business can pay people, meet deadlines and speak to its bank in the first fortnight after a loss. Clients and suppliers see continuity. Surviving partners and staff are not forced to improvise around controls, and the firm stays on the right side of its data-protection duties.
The human dividend
The dividend is predictability. Colleagues and family are spared a series of awkward requests, and everyone knows what to do and who may do it. It is a kindness arranged in advance.
The trade-offs
- Shared access widens risk. The more people who can enter a system, the more to supervise. Use role limits and logs.
- The conversation is uncomfortable. Talking about death at work is awkward, and some people will not want to.
- Notes can go stale. A continuity note that is not updated is worse than none, because it creates false confidence.
- Legal and provider rules vary. Some institutions will require formal documents, such as letters of executorship, whatever the business has prepared. Take professional advice.
Why it matters
A death reveals who held the passwords, and the lesson arrives at the worst possible moment. A little preparation, done calmly and kindly, means that the people left behind can grieve without also having to break into their own business.
Sources and further reading
- Digital inheritance - Wikipedia (last verified 10 October 2026)
- Password manager - Wikipedia (last verified 10 October 2026)
- Protection of Personal Information Act 4 of 2013 - South African Government (last verified 10 October 2026)
- Who makes an application to process Special Personal Information? (last verified 10 October 2026)
Related Mellorca reading
- The Owner Who Can't Decide Without the Spreadsheet Wizard
- Why Documented Processes Help People Grow Into Roles
- The Customer Who Gets a Different Answer From Every Person