Understand where personal data moves
We review the types of information collected, the purposes for using it and the organisations that receive it. Wallet addresses and transaction records may raise personal-data questions when linked to identifiable individuals. A useful review considers both on-chain and off-chain processing.
- Data-flow and responsibility mapping
- Assessment of controller and processor roles
- Retention and access responsibilities in policies
Prepare documents that match the service
Privacy notices should explain the service as it operates, while supplier agreements should address the work each provider actually performs. We can support reviews of legal bases, data-processing terms and international transfer arrangements. Higher-risk processing may require a more detailed impact assessment.
- Customer and website privacy notices
- Processor agreements and vendor privacy clauses
- Support for impact assessments and rights-request procedures
Plan for requests, incidents and change
Teams need a process for handling requests and assessing suspected personal-data breaches. We help document escalation and legal assessment responsibilities, coordinating with technical personnel where necessary. Contact us with your onboarding flow, main systems and provider locations. An initial discussion can identify the most relevant documents and the factual gaps that must be resolved before advice is finalised.
Your questions, answered
Are wallet addresses always anonymous?
No. Whether information relates to an identifiable person depends on the context and available means of identification.
Can AML information be kept indefinitely?
Retention must be assessed against applicable legal requirements and the purposes of processing. A documented schedule should distinguish different record categories.
General service information. The scope and provider of professional services are agreed in a separate engagement. Read our regulatory guide.