Decentralized GDPR Compliance: A Blockchain Framework for Personal Data Management

The exponential growth of digital data, combined with its widespread processing by Service Providers, has increased the risk of privacy breaches and unauthorized data usage. In response, the European Parliament and the Council of the European Union introduced the General Data Protection Regulation (GDPR) to empower individuals with control over their personal data while holding service providers accountable. However, ensuring ongoing GDPR compliance is challenging due to sporadic checks and the lack of transparent mechanisms for data owners. To address these challenges, this paper proposes a blockchain-based personal data management system designed to guarantee GDPR compliance. Key contributions include the integration of AES-encrypted CIDs for IPFS for secure off-chain storage, a hybrid data storage approach to reduce redundancy, and optimized smart contracts to minimize gas costs, enhancing scalability and extending functionalities. This system achieves scalable and comprehensive GDPR compliance through secure data management, enforcing consent, ensuring immutability, empowering data owners, and enabling service provider compliance. Experimental evaluations validate the system’s feasibility, demonstrating a significant reduction in gas costs and improved scalability and functionalities compared to existing models.