Data Privacy, Security, and Cyber Law
Domain overview
This domain tests privacy and security obligations for ledger-based systems: lawful processing, data minimisation, breach response, and cybersecurity governance. The central tension is between immutable, replicated ledgers and legal duties to correct, erase, or restrict personal data.
Core concepts
- Personal data: any information relating to an identified or identifiable person. Pseudonymous public keys and on-chain transaction graphs can be personal data when linked to an individual.
- Principles: lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
- Erasure versus immutability: design so personal data is off-chain or encrypted, with only hashes or non-personal references on-chain; hashing is not automatically anonymisation.
- Security and breach: apply appropriate technical and organisational measures, vendor oversight, incident response, and notification within legal timelines, such as GDPR 72 hours where required.
Worked example
A permissioned KYC network stores customer passports on-chain for audit. The better design keeps encrypted documents in an off-chain store with access controls, puts only a salted hash on-chain, and records deletion off-chain. The exam answer should explain why the on-chain copy defeats erasure and minimisation, and identify the controller and processor roles and breach-notification path.
Traps that cost marks
Assuming public keys are never personal data. Ignoring extraterritorial scope, including GDPR Article 3. Promising deletion from an immutable ledger without a design that permits it. Treating encryption as a complete answer without key-management and retention rules. Missing breach-notification deadlines.