A crypto service may be able or required to erase particular company-held personal records without being able to remove the associated public blockchain transaction. Where GDPR applies, assess the request record by record and consider the legal grounds and exceptions. Neither blockchain permanence nor an account-deletion button answers what must happen to every document, message and identity link held by the service.
Name the record you want addressed
Start with the material that concerns you: an identity attachment, support correspondence, a contact entry linked to an order or the public transfer itself. These are not one object merely because they concern the same exchange. Identify which organization processes each record and which activity connects it to you. Do not assume that a wallet application, an exchange and a public explorer all control the same copy.
A fictional user, Ari, supplied a document during an order review and later wants unnecessary copies removed. The relevant question for the company is what it still holds, why and under which rules. The transaction’s continued appearance in a public explorer does not demonstrate that the company retained the attachment. Conversely, a closed support ticket does not demonstrate that the attachment was erased.
| Record or link | What a focused request can address | What to ask if something remains | Conclusion to avoid |
|---|---|---|---|
| Contact details attached to an order | The company’s processing of that identifiable link | Which purpose or exception still requires it? | Removing a name necessarily removes the transfer |
| Identity document supplied for review | Retention of the attachment and relevant copies under the controller’s responsibility | Which categories remain and for how long or by what criteria? | Closing the order proves deletion of the file |
| Support correspondence | Personal information within the case and its processing purpose | Can different parts of the case receive different treatment? | The whole case must be retained or erased as a single unit |
| A public-chain transaction | The responsible processing and any relevant rights or design measures | Which actions are technically and legally available in this system? | A company can necessarily remove every distributed copy |
| A link between an address and your identity | The off-chain mapping processed by the organization | What other information could still identify you? | Removing one mapping guarantees that nobody can make the link |
| Encrypted or hashed data | The actual design and whether remaining data is still personal | What supports any claimed anonymisation? | Encryption or hashing automatically settles erasure |
This is a map for a request, not a finding about what a named provider stores. Ask for the relevant categories if you do not know them. Avoid attaching more sensitive evidence than is needed just to describe the question. An order reference and an established contact route may provide the starting context, while the controller may need proportionate further information to identify the requester.
The right is conditional, and a refusal needs a reason
The European Commission’s individual-rights explanation describes erasure grounds such as data no longer being needed or processing being unlawful. It also explains exceptions, including necessary processing for a legal obligation or legal claims. Therefore, asking for deletion is meaningful, but it does not establish that every record must disappear merely because you no longer want an account.
Ask the company to connect its answer to the data categories in your request. If it invokes a retention requirement, which records does that affect? What purpose remains, and what happens to unrelated attachments? A specific explanation is more useful than a blanket statement that all crypto data is permanent or that compliance requires everything to be kept indefinitely.
Do not claim an exception has ended just because a transaction completed, and do not accept a vague exception as evidence about every file. Keep the question grounded in the relevant processing and applicable jurisdiction. The language you use to contact a company does not by itself establish which legal regime applies to that company or to the particular processing.
Blockchain design does not make rights irrelevant
The EDPB published the final version of its blockchain guidelines on 7 July 2026. They discuss the difficulty of deleting data directly on a blockchain and the need to consider rights at the design stage. They do not treat the technology’s integrity properties as a general exemption from data-protection requirements.
A subsequent correction can leave an earlier entry visible, and encrypted or hashed information is not automatically outside personal-data rules. Whether remaining information can effectively be rendered anonymous requires the actual design and identification context to be examined. Do not assume that destroying your wallet seed deletes transaction history or that a company saying hash means no personal data has resolved every relevant question.
For Ari, this means separating a practical request about company-held copies from a demand to rewrite a public ledger. If the response discusses anonymisation, Ari can ask which personal links were addressed and what supports that description. A change in what the dashboard displays does not alone show the effect on stored records, other copies or information already made public.
Write a request that can receive a precise answer
Use the organization’s established privacy or support channel and identify the relevant interaction. Explain that the request concerns personal records under its responsibility, then list the categories you want assessed. Ask for erasure where applicable and for an explanation of any records it considers necessary to retain. Keep the request separate from an unrelated demand for a refund or a reversal of the underlying transaction.
For example, Ari could describe the completed order and the document submitted during its review, then ask which personal-data categories remain, whether erasure applies and why any retained categories are still necessary. The request should seek a category-specific answer rather than an unsupported promise to wipe the blockchain. No recovery phrase, private key or new network payment is needed to formulate that inquiry.
- Identify the organization and interaction, using an established contact route.
- List the personal records and links you want assessed, distinguishing them from the public transaction.
- State the requested action and ask for the grounds if any category cannot be erased.
- Provide only the information needed to establish the request and confirm identity through the genuine process.
- Keep the request, acknowledgement, relevant notice and response together.
- If the answer is incomplete, identify the unresolved category and the available complaint route rather than sending more transfers.
A response deadline is not a promise that every copy vanishes
The EDPB rights guide explains the one-month response period and the possible extension by two further months for a complex request, with notice within the first month. It also addresses identity checks and reasons for refusal. Do not convert that response framework into a claim that every blockchain-related copy must be deleted within a fixed number of days.
Check what the answer actually confirms: data erased, a request refused in part, retention justified or a question still being investigated. A complaint to a competent data-protection authority is a separate process, not an automatic reversal or guarantee of deletion. Preserve the relevant correspondence so the remaining issue can be understood without publishing your identity files in a public forum.
KOT.CASH’s AML policy describes risk-based reviews and possible requests for identity or source information. Read how the service works alongside a simple swap and keep the order reference when asking about related records. No-account exchange does not itself establish zero retention or instant erasure. This article does not determine KOT.CASH’s controller status, GDPR applicability or retention periods; those require the actual operator’s relevant information and circumstances.
FAQ
Does GDPR require a crypto exchange to delete the blockchain transaction?
A request must distinguish the distributed record from the company’s personal-data processing and off-chain links. The available rights and measures depend on the actual system, grounds and applicable rules; an exchange cannot be assumed to control every copy of a public chain.
Can I make a right-to-erasure request about crypto support documents?
Yes, where the relevant data-protection regime applies, identify those records and ask the responsible controller to assess erasure. The answer may involve legal grounds or exceptions, so request an explanation for any category retained.
Does a hash make blockchain data exempt from the right to be forgotten?
Not automatically: the design and whether information remains identifiable matter. A label such as encrypted or hashed is not, on its own, proof of effective anonymisation or compliance.