The tension between a public ledger and a privacy statute
A public blockchain records every transaction permanently and makes the record available to anyone. A data protection statute requires organisations to collect personal data only for notified purposes, to keep it accurate, to retain it no longer than necessary, to correct it on request and to protect it from unauthorised access. The two are in evident tension. The Singapore regulator has addressed it directly. This chapter sets out the Personal Data Protection Act 2012 as it applies to digital-asset businesses and the position on wallet addresses as personal data. It then turns to the cross-border transfer rules that govern a Swiss–Singapore group, the overlay of the Cybersecurity Act 2018 and the conflict between privacy duties and the anti-money laundering duties described in Part L.
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.