Wallet addresses and on-chain data as personal data

The regulator's position

The Commission published a guide on data protection considerations for blockchain design in July 2022. It takes three central positions. Data written to a blockchain is personal data if the individual can be identified from it in combination with other information. An organisation that writes personal data to a blockchain remains responsible for it as a data controller. Pseudonymised data such as a wallet address or a hashed identifier may still be personal data where the organisation or others can link it to an individual.¹ The guide recommends that personal data be kept off-chain with only hashes or references on-chain and that permissioned networks be used where the participants can be bound by contract. Organisations should assess whether their use of a public blockchain is consistent with the retention limitation and correction obligations before deploying.

Consequences for exchanges and protocols

An exchange that knows the identity of the customer behind a wallet address holds personal data in that address. Every transaction the customer makes on-chain from that address, which is public, is therefore personal data in the exchange's hands. The exchange's disclosure of the link between address and identity is a disclosure of personal data requiring consent or an exception. The exceptions cover disclosure required by law, which includes disclosure under a court order of the kind made in CLM v CLN and disclosure to law enforcement, and disclosure necessary for an investigation or proceedings.² An exchange served with a disclosure order should comply and should not treat the Act as a reason to delay. An exchange asked informally by a claimant's lawyer for account-holder details should refuse, because no exception covers voluntary disclosure to a private party.

Protocols face a different problem. A developer who writes an identity attribute to a public chain, for instance a soulbound token recording that an address has passed verification, has created a permanent public record that cannot be corrected or deleted. The Commission's guidance treats this as a design failure unless the attribute cannot be linked to an individual. In practice the only safe design keeps identity off-chain and records on-chain nothing more than a cryptographic proof that a verification occurred.

Notes

Personal Data Protection Commission, Guide on Personal Data Protection Considerations for Blockchain Design (July 2022). ↩
Personal Data Protection Act 2012, First Schedule (exceptions to consent), including disclosure required or authorised by law and disclosure necessary for investigations or proceedings. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.

English

Contact

Dr Alexander Ressos, TEP

Of Counsel, KGP Legal LLC

I am Of Counsel with KGP Legal LLC in Singapore, where I work with a global client base of successful entrepreneurs and their families, independent asset managers, commodity trading houses and other commercial clients. I am a German and Swiss attorney-at-law, also admitted as a solicitor in England & Wales and in Hong Kong. I divide my time between Zug in Switzerland, Singapore and Hong Kong. Since 2017 I have advised international clients on more than 700 crypto and digital asset projects. I also have extensive experience in cross-border litigation and arbitration in Singapore, Hong Kong and other markets in South-East Asia and Greater China.

I operate across the key financial centres in South-East Asia, the Middle East and Switzerland, with a particular focus on asset protection, international tax and estate planning, as well as trusts, company administration and other fiduciary services. My philosophy is to serve as a trusted advisor working closely with my clients and to help them achieve their commercial objectives.

All Singapore law advice is provided through KGP Legal LLC, an established and duly licensed firm of Singapore advocates and solicitors.

KGP Legal LLC is a medium-sized law firm in Singapore that is capable of providing the full range of legal services and corporate administration work. Please contact me if you need any further information.

Get in touch →

Articles and Insights

Setting up or expanding in Singapore?

SingaporeIQ is edited by Dr Alexander Ressos, an international business lawyer with more than 15 years of local experience in Singapore as a permanent resident, a Singapore registered foreign lawyer and managing partner of a Singapore foreign law practice. In addition to significant experience in cross-border investments and transactions, UHNWI private client work and sanctions/export controls, Dr Ressos has extensive experience in cross-border business and in crypto and digital-asset projects in Singapore, drawn from more than 700 projects since 2017.

If you are planning a company incorporation, an investment, a holding structure or a market entry through Singapore, you can reach Dr Ressos directly at [email protected]. Singapore law advice is provided by KGP Legal LLC, a licensed firm of Singapore advocates and solicitors. Dr Ressos and his team facilitate the full range of Singapore legal, compliance and company administration services, including company incorporation, corporate transactions, commercial contracts, crypto and digital assets, financial regulatory work and dispute resolution, including litigation in the Singapore courts. For Hong Kong, our parallel site HongkongIQ.com offers the same practical guidance. For crypto and digital assets, dltreg.com covers legal, tax and fiduciary services. For legal, tax and fiduciary services in Switzerland, see helveticaregister.com.