---
title: "Architecting for Privacy and Data Protection on Hedera"
id: "16005"
type: "post"
slug: "architecting-for-privacy-and-data-protection-on-hedera"
published_at: "2021-11-11T00:00:00+00:00"
modified_at: "2025-12-09T17:08:21+00:00"
url: "https://hedera.com/blog/architecting-for-privacy-and-data-protection-on-hedera/"
markdown_url: "https://hedera.com/blog/architecting-for-privacy-and-data-protection-on-hedera.md"
excerpt: "Read the new paper, How Distributed Ledger Technology (DLT) Serves as Web 3 Privacy Architecture; a level-set of what privacy and data protection actually means in today’s highly-regulated world and apply it to distributed ledger technology."
taxonomy_category:
  - "Uncategorized"
---

[Skip to content](#content)
blog

# Architecting for Privacy and Data Protection on Hedera

November 11, 2021

Debra Farber

Privacy Strategist

I am excited to share with you my Hedera whitepaper: **[How Distributed Ledger Technology (DLT) Serves as Web 3 Privacy Architecture](/HH_Web-3-Privacy-Architecture)**, a labor of love.

When I first dove into the world of distributed ledger technology at the beginning of 2020, having 16+ years of operational privacy expertise, I was surprised by how stakeholders in the crypto space discussed and framed the topic of “privacy.” I saw many posts claiming “there is no privacy without anonymity.” Of course, those who typically make such an assertion really intend it to mean anonymity of financial transactions via “privacy coins” and skip over the many other uses of personal data collected or processed by organizations. This paper aims to start filling that very wide gap.

Anonymity is actually an edge case. As social creatures, humans don’t typically move around in public spaces with their faces obscured (with exceptions for religious preferences, mask-wearing during a pandemic, etc.). Shrouding ourselves in anonymity is an edge case we typically deploy when we want our voices heard without attribution, thus avoiding blowback for one’s opinion. Unfortunately, some in the crypto world conflate unfettered speech with privacy. While both free speech and privacy may be necessary to achieve the aims of “freedom,” they are, in fact, completely different concepts. The EU’s [General Data Protection Regulation](https://gdpr-info.eu/)
 (GDPR), the [California Consumer Privacy Act](https://www.oag.ca.gov/privacy/ccpa)
 (CCPA), India’s pending Personal Data Protection Bill (PDPB), and other similar pieces of legislation around the world have outlined a framework for the collection and processing of personal data within various countries’ jurisdictions. I plan to write more about anonymity vs. privacy in an upcoming blog post. For now, I simply want to introduce you to why I was inspired to draft this whitepaper.

After spending the past several years evangelizing the frameworks for “Privacy by Design and Default,” which companies must embed into their product and service offerings via “Privacy Engineering” methodologies, practices, and tools, I saw an opportunity to educate those endeavoring to build on DLT, especially for companies who want to earn and keep trust. Since Hedera’s founders built an enterprise-grade public DLT with the vision to create a 100-year+ company, I knew Hedera was the organization with which I wanted to partner on privacy, as those who seek to build on [Hedera Consensus Service](https://hedera.com/consensus-service)
 or [Hedera Token Service](https://hedera.com/token-service)
 are those who can benefit most from better understanding their privacy and data protection obligations. This is part of the great “shift left” that the security industry has been championing for years, to address risks (including privacy risks) earlier in the software development lifecycle. We finally have strong, global data protection laws in major markets that require organizations to “shift left” for privacy.

My intent with writing this whitepaper is to level-set what privacy and data protection actually means in today’s highly-regulated world and apply it to DLT. I start with a crash course in data protection rights and obligations. I then flesh out the privacy characteristics of Hedera’s services. Lastly, I highlight privacy pitfalls to avoid. Note, however, that this is not a full overview of all things data protection. There are many concepts I chose not to include in this paper in order to strip the legalese and leave only brevity and clarity; so, do seek advice from your privacy and data protection counsel and consultants to understand your company’s actual legal risks.

To build upon concepts and serve as a guide for DLT architects and developers, the paper is separated into three sections.

**Section 1: Global Privacy Requirements**

Understand essential privacy and data protection requirements of which architects and developers should be aware. It describes critical global data protection rights afforded to individuals and organizational obligations to respect and facilitate those rights, data minimization, accountability, security, and privacy by design and default.

**Section 2: Architectural Considerations**

This section describes emerging architectural patterns for deploying decentralized applications and three privacy and data protection pitfalls to avoid: 1) who is accountable for compliance, 2) deletion of personal data from the blockchain or hashgraph, and 3) the finality of smart contracts made in error.

**Section 3: Inheriting Trust via Hedera**

Hedera offers a variety of network services to interact with the public ledger. For each network service, there are relevant privacy considerations based on how the data flows through the network and its deployment options.

I see this whitepaper as the foundational document for a broader privacy platform, and I anticipate making updates to it as I receive feedback from the Hedera community and as the ecosystem evolves. However, now that it has been published, I am excited to bring to you additional educational content on specific areas of privacy and data protection. Up next on my list are deep dives into data minimization, NFTs for consent and assurances around digital rights, and accountability. Of course, I also plan to give my fuller perspectives on anonymization and decentralization, some hotly debated issues in DLT! Hello Future.

[Read paper](/HH_Web-3-Privacy-Architecture)

[Back to Blog](/blog)

discover

See more articles

[View All](/blog)

August 5, 2026

### Details decide. What digital asset policy did in July 2026

Halfway through 2026, the regulatory picture is coming into focus. Hedera Chief Policy Officer Nilmini Rubin and VP Global Policy Isadora Arredondo break down what moved in June across the

[Read More](https://hedera.com/blog/details-decide-what-digital-asset-policy-did-in-july-2026/)

July 17, 2026

### Deploy Multichain Dapps on Hedera in 60 Seconds with scaffold-hbar

Deploying multichain dapps on Hedera has never been easier! With just one command, you can spin up a fully functional dapp using Next.js, Hardhat or Foundry, and AI agent context…

[Read More](https://hedera.com/blog/deploy-multichain-dapps-on-hedera-in-60-seconds-with-scaffold-hbar/)

July 13, 2026

### Regulation is finding its form in summer 2026

Halfway through 2026, the regulatory picture is coming into focus. Hedera Chief Policy Officer Nilmini Rubin and VP Global Policy Isadora Arredondo break down what moved in June across the

[Read More](https://hedera.com/blog/regulation-is-finding-its-form-in-summer-2026/)

## Ready to get started?

Discover why Hedera is the trusted institutional-grade network powering the new digital economy.

[Start Building](/start-building)

[Contact](/contact)

We use cookies to deliver the best experience on our website and to analyze traffic. By continuing to use this site, you consent to our cookie policy.

Review our [Privacy Policy](/privacy)
 to understand how Hedera collects and uses information.

Accept All CookiesAccept Necessary Cookies