'I'm sorry for your loss' is another phrase which is often used.

"I am very sorry to hear that." if you want to add more: "Please accept my heartfelt condolences." Personally, I would avoid "I'm sorry for your loss." if it's someone you care about very much (i.e. either the deceased or the person that you're talking to.). This phrase tends to get overused and (to my ears, at least) sounds a bit trivial or insignificant.

The IMPORTANT thing is that you say something, not how you say it. Young people tend to get anxious about saying or doing "the right thing" in situations involving death, but it's not important. "I'm sorry to hear that" is fine. If the death was sudden or surprising, "Oh, how terrible" or something like that. If you actually know the person who died, even casually, and know something nice about that person, one short comment is appropriate. "Oh, how terrible. I'm sorry to hear it. She had such a wonderful sense of humor."

"My condolences" is also a suitable phrase.