The Scenario
Kaveri runs a small trading firm. As part of onboarding a fintech lending platform, she completed a KYC process in 2022. The platform had built its KYC infrastructure on a consortium blockchain shared across six lenders.
In 2024, Kaveri closed her account and formally requested that her KYC data be removed. The fintech replied that the KYC records were permanent, shared across the consortium, and could not be altered because that would “break the chain’s integrity.”
Meanwhile, one lender in the consortium — located in a foreign jurisdiction — faced a regulatory investigation. Kaveri’s personal data was accessed by foreign law enforcement as part of that investigation, without her knowledge.
The Two DPDP Act Violations
Violation one: Section 12(3) — erasure right denied. The fintech’s architecture made it structurally impossible to honour a statutory right. That is a compliance failure attributable to design, not a force majeure.
Violation two: Rule 15 of the DPDP Rules, 2025 — foreign state access restrictions. Rule 15 prohibits a Data Fiduciary from enabling foreign governments or their instrumentalities to access personal data of Indian Data Principals except through legal channels prescribed by Indian law. Kaveri’s data was accessed by a foreign authority through a consortium node without any such channel being invoked.
This is precisely the data sovereignty concern that the Puttaswamy judgment (2018) framed when it recognised informational self-determination as a fundamental right. The Supreme Court observed that humans forget, but the internet does not. Blockchain amplifies this observation: not only does the internet not forget — the chain mathematically cannot.
The IS Audit Perspective
IS Audit course material of ICAI notes that credential security on blockchain is only as strong as the access point, and that not all participants in a public or consortium chain can be assumed to have equivalent governance standards. Furthermore, Section on Governance and Controls requires that organisations assessing blockchain solutions audit cross-border data flows as a primary governance item.
The Compliance Architecture Fix
Consortium blockchain participants must establish a data governance charter before deployment, specifying: which personal data categories may be written on-chain; cross-border node participation restrictions consistent with Rule 15; erasure and key-revocation protocols binding on all nodes; and a Data Processor contract between the consortium and each member lender covering DPDP Act obligations.
Kaveri’s case is not hypothetical. Indian KYC infrastructure today sits at exactly this intersection.
The Central Compliance Question for Blockchain Deployments
The immutability of blockchain is not, by itself, illegal under the DPDP Act. However, placing personal data directly on an immutable ledger without designing for erasure is a compliance failure. The DPDP Act does not prohibit blockchain. It requires that every technology deployment — including blockchain — be architected so that Data Principal rights can be exercised.
There are four questions every organisation must answer before writing personal data to a blockchain:
One. Can we honour a Section 12(3) erasure request without breaking the chain? If not, the architecture must change before deployment.
Two. Does every node in our network have a written Data Processor agreement under Section 8(2)?
Three. Do any nodes sit in foreign jurisdictions? If so, does Rule 15 governance apply, and is it documented?
Four. Have we used off-chain storage with on-chain hashes, or encryption-at-rest with key deletion on erasure, to build in a compliance exit?
IS Audit study material by ICAI frames this governance requirement clearly: organisations implementing or assessing blockchain solutions must evaluate legal and compliance risk as a first-order item, not an afterthought. The DPDP Act makes this mandatory. The deadline is 13 May 2027.
What Responsible Blockchain and DPDP Compliance Looks Like
The DPDP Act does not ask organisations to abandon blockchain. It asks them to build it responsibly. Consequently, the organisations that will navigate this intersection well are those that:
Design data architecture around erasure rights from day one. Keep personal data off the immutable ledger wherever possible. Use encryption and key management as a proxy for deletion where off-chain storage is not feasible. Govern every node as a Data Processor. Apply Rule 15 restrictions to every cross-border node participant. And audit the entire architecture annually under IS Audit 3.0 standards.
Blockchain is a powerful technology. The DPDP Act is a serious law. Used together — with care — they are compatible. Used carelessly, they create the hardest compliance problems in India’s data protection landscape. Disclaimer
The contents of this post are intended for general awareness and informational purposes only. They do not constitute legal opinion, professional advice, consultancy, statutory interpretation, or a recommendation to act in any particular manner.
The Digital Personal Data Protection Act, 2023, related rules, notifications, regulatory guidance and judicial interpretations may evolve from time to time. The applicability of the law may also vary depending on the facts, sector, nature of data processing, organisational role, contractual terms and compliance framework.
Readers should not rely solely on this post for making legal, business, HR, technology, data-processing or compliance decisions. Specific advice from a qualified legal, privacy, cybersecurity, governance or compliance professional should be obtained before acting on any matter discussed.
The author / publisher shall not be responsible for any loss, liability, claim, penalty or consequence arising from reliance on the contents of this post without independent professional advice.
Authors:
This article has been co-authored by CA. Sunil Elayadath and CA. Karthik Narayanan S, Partners of Karthik & Sunil, together with Mr. Dhanesh P. K., Designated Partner, DSK Sustainability Tech.
