Can blockchain or immutable storage be used for records when privacy laws require you to delete personal data on request?

Blockchain and write-once, immutable (WORM) storage are valued for one reason: once data is written, it cannot be quietly altered or deleted. That same property collides directly with privacy laws that grant individuals a right to have their personal data corrected or erased on request. The tension is real, but it is manageable with the right design choices.

Why the conflict happens

Immutability is a feature, not a flaw. It proves a record has not been tampered with. But a right-to-deletion (or rectification) request assumes you can remove or change specific personal data. If you have committed someone’s name, address, or biometric data directly to an unchangeable ledger or WORM volume, honoring an erasure request becomes technically difficult or impossible. Privacy regulators have repeatedly flagged on-chain storage of personal data as a poor fit for this reason.

Practical approaches

The common pattern is to keep personal data off the immutable layer and store only non-identifying proof on it:

• Hash, don’t store. Write a cryptographic hash or pointer to the ledger, while the actual personal data lives in conventional, deletable storage. The hash proves integrity without containing the data itself.
• Off-chain with on-chain proof. Keep records in a normal repository governed by retention and disposition rules; use the immutable layer only to timestamp or verify them.
• Crypto-shredding. Encrypt personal data and destroy the key on an erasure request. The ciphertext may persist, but it becomes unreadable — a recognized way to achieve functional deletion.
• Data minimization at the source. Avoid placing personal data anywhere immutable unless a clear legal basis requires it.

How to decide

Treat this as a records and privacy-by-design question, not a technology question. Map what data you actually need to make immutable, identify any personal data within it, and confirm whether a retention obligation or legal hold overrides a deletion request — sometimes it does. Standards like ISO 15489 emphasize that records systems must support disposition, and privacy frameworks emphasize giving individuals control over their data; an immutable design should be reconciled with both before adoption.

When in doubt, involve legal, privacy, and records stakeholders early. Immutability and erasure can coexist — but only if you design the boundary between proof and personal data from the start.

Learn more on the privacy and PII hub.