The General Data Protection Regulation (GDPR) sets a high bar for how organizations process personal data. For verification infrastructure — which by its nature handles identity attributes, credential data, and verification records — GDPR compliance is not optional. This guide explains how Truthlocks approaches GDPR compliance and how our architecture supports your obligations as a data controller.
Data Roles: Controller vs. Processor
Understanding data roles is the foundation of GDPR compliance. In most Truthlocks deployments:
- Your organization is the data controller. You determine the purposes and means of processing personal data — for example, deciding to verify a customer's professional license as part of onboarding.
- Truthlocks is the data processor. We process personal data on your behalf, according to your instructions, using the infrastructure and APIs we provide.
This distinction matters because GDPR assigns different obligations to controllers and processors. As a processor, Truthlocks is required to process data only according to documented controller instructions, implement appropriate security measures, assist with data subject requests, and notify controllers of data breaches without undue delay.
Data Processing Agreements
Article 28 of the GDPR requires a written data processing agreement (DPA) between controllers and processors. Truthlocks offers a standard DPA template that covers the required provisions, including the subject matter and duration of processing, the nature and purpose of processing, the types of personal data processed, the categories of data subjects, and the obligations and rights of the controller.
Enterprise customers can access and execute the DPA through the Truthlocks Console. Custom DPA provisions are available for customers with specific regulatory requirements.
Data Residency
GDPR restricts the transfer of personal data outside the European Economic Area (EEA) unless adequate safeguards are in place. Truthlocks is building toward regional deployment options to address this:
- EU region: All data — including attestation payloads, verification records, audit logs, and encryption keys — is stored and processed within EU data centers (AWS eu-west-1 and eu-central-1). No data leaves the EU boundary.
- US region: Data is stored and processed in US data centers for customers who prefer or require US residency.
- Multi-region: Enterprise customers can configure data residency at the tenant level, supporting organizations that operate across jurisdictions.
For cross-border data flows that are necessary (e.g., a US-based verifier checking a credential issued in the EU), we rely on Standard Contractual Clauses (SCCs) as the legal transfer mechanism, supplemented by technical measures including encryption in transit and at rest.
Right to Erasure (Article 17)
Data subjects have the right to request erasure of their personal data. This creates a tension with verification systems, where certain records must be retained for legal or regulatory reasons. Truthlocks handles this through a layered approach:
- Personal data erasure: When a data subject exercises their right to erasure, all personally identifiable information in attestation payloads is cryptographically shredded — the data encryption key for that subject's records is destroyed, rendering the encrypted data permanently unrecoverable.
- Verification records: The fact that a verification occurred (timestamp, result, issuer) may be retained in pseudonymized form if the controller has a legitimate basis (e.g., regulatory record-keeping). The pseudonymization removes all direct identifiers.
- Transparency log entries: Log entries are retained with the personal data replaced by a hash. This preserves the log's integrity (the merkle tree remains consistent) while removing personal data.
Controllers can trigger erasure requests through the API or the console. The erasure process is logged as an audit event so that compliance teams can demonstrate that requests were fulfilled within the GDPR's one-month deadline.
Retention Policies
GDPR's data minimization principle requires that personal data not be kept longer than necessary. Truthlocks supports configurable retention policies at the credential-type level. For example:
- KYC verification records: 5-year retention (aligned with financial services regulations).
- Employment verification records: retained for the duration of the employment relationship plus 1 year.
- Event attendance credentials: 90-day retention.
When a retention period expires, the platform automatically triggers the cryptographic shredding process described above. Controllers receive a notification confirming that expired data has been purged.
Privacy by Design
Article 25 of the GDPR requires data protection by design and by default. Truthlocks embeds privacy into the architecture rather than treating it as an afterthought:
- Minimal data collection: The platform collects only the data necessary for the requested verification. We do not profile data subjects, build behavioral models, or monetize personal data.
- Encryption by default: All personal data is encrypted at rest (AES-256) and in transit (TLS 1.3). Tenant-specific encryption keys ensure that a key compromise affects only one tenant.
- Selective disclosure: Our ZKP-based selective disclosure feature lets data subjects prove attributes without revealing underlying personal data — the strongest possible form of data minimization.
- Access controls: Role-based access control (RBAC) with the principle of least privilege ensures that only authorized personnel can access personal data, and only the minimum data necessary for their role.
- Audit logging: Every access to personal data is logged, creating an accountability trail that supports compliance monitoring and incident investigation.
Breach Notification
In the event of a personal data breach, GDPR requires processor-to-controller notification without undue delay. Truthlocks commits to notifying affected controllers within 24 hours of confirming a breach that affects personal data. Our notification includes the nature of the breach, the categories and approximate number of affected records, the likely consequences, and the measures taken to address the breach and mitigate its effects.
Your GDPR Compliance Checklist
When using Truthlocks as your verification infrastructure, ensure you have:
- Executed the Truthlocks DPA (available in the console).
- Configured your data residency region.
- Defined retention policies for each credential type.
- Implemented a process to forward data subject requests (access, erasure, portability) to the Truthlocks API.
- Updated your privacy policy to describe your use of verification infrastructure.
- Conducted a Data Protection Impact Assessment (DPIA) if your verification activities are high-risk.
For detailed implementation guidance, see the GDPR compliance section of our documentation or contact our compliance team through the console.