Blockchain technology has evolved far beyond its cryptocurrency origins, with organizations increasingly exploring different use cases and its potential for storing and managing various types of data.

Blockchain’s characteristics of immutability, transparency, decentralized data management, and availability have attracted attention across industries, from finance, to supply chain management, to healthcare, and many more. However, these features create significant challenges when it comes to regulatory compliance, specifically:

• Immutability: Once recorded on the blockchain, data cannot be altered or deleted.
• Transparency: All network participants can see all data and verify the data's authenticity.
• Decentralization: No single entity controls the data, nor is singularly responsible for it.
• Availability: Data is replicated, hence accessible across multiple nodes.

Blockchain Compliance is Not Just for Crypto

Depending on the business and data managed by a company, modern blockchain applications may fall under the scope of different regulatory frameworks. Recently, financial authorities across the globe have been developing and releasing regulatory frameworks, which have attracted media and general public attention. However, there are other laws and prescriptions that apply to companies which handle personal identification data, healthcare records, business documents, digital credentials, and many more.

This article will focus on the impact of privacy and data protection regulatory frameworks, related to personal and health data, when leveraging blockchain technology.

Core Challenges in Privacy and Data Protection Regulatory Frameworks

In the regulatory landscape, there are many overlapping requirements between privacy and personal data protection (like GDPR, CCPA/CPRA, PIPL, etc.), and health data protection (like HIPAA). These overlaps are primarily due to the sensitive nature of the data involved, which demands similar considerations about data protection, security and privacy.

Since these regulations were developed before mainstream adoption of blockchain technology, they do not include any explicit references to blockchain, nor do they directly address blockchain-related issues. However, they still apply to companies dealing with personal and/or health data leveraging blockchain.

In particular, blockchain's core characteristics introduce some challenges when complying with data protection and privacy requirements:

In the next sections, we will present a deep dive for each challenge, how companies can address privacy and data protection requirements while using blockchain, and how CertiK can help within this context.

Immutability

Blockchain’s immutable nature presents several significant regulatory compliance challenges, especially in consideration of users’ rights to modify or delete data, and overall retention requirements.

Transparency

Access control requirements, aimed at protecting users’ privacy, create complex challenges when implementing blockchain solutions.

Decentralization

Blockchain’s decentralized nature, especially in terms of governance, leads to potential conflicts with regulatory requirements over roles and responsibilities.

Availability

Geographic distribution of blockchain nodes creates significant compliance challenges on data residency and data transfer.

Solutions

Hybrid Storage Models

Hybrid storage models have emerged as a leading solution for balancing blockchain benefits with compliance requirements. These models strategically divide data between on-chain and off-chain storage:

• Sensitive data is stored in traditional, compliant databases.
• Only references and verification proofs are stored on the blockchain.
• Changes to sensitive data can be made in off-chain storage.
• Blockchain maintains an immutable audit trail.

The following challenges may be addressed, assuming that, with a hybrid storage model, sensitive data would be stored in traditional/off-chain storage solutions:

• Immutability: Data deletion and modification is addressed with off-chain storage while maintaining integrity. Additionally, retention policies can be implemented with off-chain data.
• Transparency: Security, access control, and encryption of sensitive data can be enforced and managed with off-chain storage.
• Decentralization: Roles and responsibilities over traditional storage solutions can be easily attributed.
• Availability: Data location and storage jurisdictions can be controlled.

For instance, healthcare providers store patient records in traditional HIPAA-compliant databases while using blockchain to track access logs and data integrity. This process enables them to modify/delete records when required, maintain compliance with retention policies, control data location, and preserve an immutable audit trail. Estonia's e-Health system stores patient records in off-chain databases while using KSI blockchain to secure health record access logs and maintain data integrity across its national healthcare network.

Private & Permissioned Networks

Private blockchain networks provide organizations with control over network participation, privileges, and data governance, while maintaining distributed benefits:

• Controlled network membership through authentication and authorization.
• Role-based permissions defining data access and node operation rights.
• Configurable consensus mechanisms and governance rules.
• Geographic control over node distribution.

These networks address the following challenges:

• Transparency: Access to data can be controlled at a granular level, addressing security and privacy requirements (which could be strengthened by also applying encryption).
• Decentralization: Roles and responsibilities, like controller/processor, can be clearly assigned.
• Availability: Data location and distribution can be controlled.

One example of this is that private and permissioned networks can enable granular access control on health-related data and secure healthcare collaboration while maintaining patient privacy:

• Healthcare providers maintain control over patient record access.
• Each participant accesses only their authorized portions of medical records.
• Clinical partners have role-specific permission levels.
• Patients can share records without exposing their complete medical history.

For instance, Medicalchain uses Hyperledger Fabric's permissioned architecture to enable different access levels, allowing patients to control who can view their records, what specific information they can see, and for how long. Additionally, healthcare providers, such as Leeds Teaching Hospital Trust and Queen Elizabeth Hospital, can securely exchange patient data while meeting regulatory requirements.

Zero-Knowledge Proofs

Zero-Knowledge Proofs enable verification of information without exposing underlying data, providing a powerful solution for maintaining privacy while meeting compliance requirements. No sensitive data is stored on-chain; only a proof to verify data truthfulness is hosted on the blockchain. Some important characteristics include:

• Generates mathematical proof of data validity.
• Verifies claims without revealing underlying data.
• Enables selective disclosure of information.
• Maintains data confidentiality during verification.

Assuming that sensitive data is properly stored off-chain, in accordance with data protection and privacy requirements, the following challenges will be addressed:

• Immutability: Data modification and deletion, as well as retention policies, are addressed off-chain, while preserving the possibility to verify data truthfulness on-chain.
• Transparency: Enables verification of data on-chain while protecting sensitive data confidentiality off-chain.
• Decentralization: Roles and responsibilities over sensitive data are addressed using off-chain storage solutions.
• Availability: Data location and distribution depends on off-chain data storage, while verification is available on-chain.

Financial institutions can implement ZKP-based KYC processes where:

• Customers prove their identity requirements without exposing raw personal data.
• Banks verify regulatory compliance without storing sensitive information.
• Identity verification results are stored on-chain while protecting privacy.
• Multiple institutions can verify customer status without redundant checks.

For instance, Privado ID (formerly Polygon ID) enables organizations to issue W3C-standard verifiable credentials where users can prove specific claims (like KYC status) to verifiers without revealing underlying personal data. This process combines blockchain-based verification with zero-knowledge proofs to ensure both compliance and privacy.

Conclusion

The intersection of blockchain technology and regulatory compliance presents significant challenges, but emerging solutions could offer practical approaches to bridge this gap. The following table maps key challenges to their corresponding solutions. Note that the representation in the table assumes that sensitive data stored off-chain is managed in accordance with data protection and privacy requirements:

Key takeaways:

1. No single solution addresses all compliance challenges while hosting sensitive data on-chain, and maintaining the original characteristics and ideals of blockchain technology. Combined approaches, and considering specific business and operational requirements, might be the best solution.
2. Developing with compliance in mind from the start, rather than as an afterthought, should support the identification of suitable blockchain characteristics (i.e. public/private, permissionless/permissioned, etc.) and any additional solutions.
3. Since regulations are still under development and technical solutions are evolving, it is important to stay informed on the latest advancements.

As blockchain technology and regulatory frameworks mature, organizations that thoughtfully combine these solutions will be well-positioned to leverage blockchain's benefits while maintaining compliance.

CertiK can support companies adopting blockchain in all stages of development, including those managing personal and sensitive data. We provide services, which include:

• Analyzing infrastructure and data designs, or existing environments, to identify applicable regulatory frameworks;
• Assessing infrastructure and data designs, or existing environments, to identify ICT and regulatory risks;
• Recommending actions to address ICT and regulatory risks;
• Identifying suitable solutions to leverage blockchain technologies while maintaining regulatory compliance.