Verifiable credentials and GDPR: what relying parties are actually accountable for

A recurring conversation in MyAura deployments goes roughly: "If the user holds the credential and we only receive an attestation, are we still a data controller?"

Usually yes. But the scope of what you control shrinks considerably, and that is the real win.

What actually changes

Under a traditional KYC flow you collect a passport scan, a proof of address and a bank statement. You store them, you secure them, you are accountable for them, and you carry the breach risk for as long as your retention policy says.

With a verifiable credential you receive a signed statement that a named issuer verified those documents, plus whatever derived claims you asked for. You never hold the passport scan. The data you control is smaller, less sensitive and easier to justify under data minimisation.

That is a genuine reduction in risk. It is not a removal of obligation.

Where you are still accountable

Lawful basis. You need one for processing the attestation, exactly as you did for the documents. Consent is often the wrong choice here — legitimate interest or legal obligation usually fits better for regulated onboarding.

Purpose limitation. An attestation obtained for account opening cannot be silently reused for marketing segmentation. The narrower payload does not widen your permitted purposes.

Retention. You still need a defensible retention period for the attestation and the verification record. Shorter than a document retention policy, but not zero — supervisory authorities will ask you to evidence the check happened.

Subject rights. Access, rectification and erasure requests still land on you for the data you hold. What improves is that there is less of it, and that the source of truth for correction sits with the issuer rather than in your archive.

Selective disclosure is a design decision

The technology lets you ask for "income above threshold" instead of a salary figure. Nothing forces you to. We have seen implementations that adopt verifiable credentials and then request the full underlying document anyway, out of habit or because a downstream system expects it.

That throws away most of the benefit. If the downstream system needs the document, the honest position is that you have changed the transport mechanism, not the privacy posture, and your DPIA should say so.

The practical test

Ask what a breach of your systems would expose about a customer, before and after. If the answer is meaningfully smaller, the architecture is doing its job. If it is the same, something in the integration has quietly defeated the point.