{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,25]],"date-time":"2026-10-25T18:34:10Z","timestamp":1792953250128,"version":"4.5.0"},"reference-count":21,"publisher":"VidhiAagaz","issue":"V","license":[{"start":{"date-parts":[[2026,10,25]],"date-time":"2026-10-25T00:00:00Z","timestamp":1792886400000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IJLMH"],"abstract":"<jats:p>As high-risk Artificial Intelligence (AI) systems are deployed at an unprecedented pace, regulators around the world have, for the first time, required continuous and tamper-proof auditing. In the context of the European Union AI Act, technology providers increasingly use Distributed Ledger Technology (DLT) to build distributed and permanent audit trails in order to meet the record-keeping requirements of Article 12 and the accuracy, robustness and cybersecurity requirements of Article 15. This append-only design, however, presents a fundamental techno-legal conundrum in the face of statutory data erasure rights, such as the \u201cright to be forgotten\u201d under Article 17 of the EU GDPR and the right to erasure under Section 12 of India\u2019s Digital Personal Data Protection (DPDP) Act 2023. This paper explores whether privacy-preserving cryptographic methods can reconcile the requirement to delete personal data permanently with the mathematical immutability of distributed ledgers. Using a comparative doctrinal and techno-legal approach, it examines several prominent mitigation architectures, namely off-chain data storage with cryptographic pointer scrubbing, Zero-Knowledge Proofs (ZKPs) and redactable blockchains. It argues that physical changes to the ledger significantly disrupt the digital chain of custody and can destroy evidence that is critical for court cases and administrative oversight. The study therefore recommends a shift from the physical deletion of data to a new set of rules of \u201cfunctional erasure\u201d, to be formally recognised in law, under which the irreversible destruction of the decryption key (\u201ccrypto-shredding\u201d) is sufficient to meet compliance. Finally, it offers concrete policy proposals for the European Data Protection Board and the Data Protection Board of India to create harmonized key-governance protocols and cross-border regulatory sandboxes that allow harmonized compliance in digital markets across the globe.<\/jats:p>","DOI":"10.63108\/ijlmh.13094","type":"journal-article","created":{"date-parts":[[2026,10,25]],"date-time":"2026-10-25T18:01:44Z","timestamp":1792951304000},"page":"3394-3403","source":"Crossref","is-referenced-by-count":0,"title":["The Immutability\u2013Privacy Paradox in AI Governance: Reconciling Blockchain-Backed Regulatory Audit Trails under the EU AI Act with Data Erasure Rights under GDPR and DPDP 2023"],"prefix":"10.63108","volume":"9","author":[{"given":"Anurag","family":"Choudhary","sequence":"first","affiliation":[{"name":"Assistant Professor at Sardar Patel Subharti Institute of Law, Swami Vivekanand Subharti University, Meerut, Uttar Pradesh, India"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"19992","published-online":{"date-parts":[[2026,10,25]]},"reference":[{"key":"ref1","doi-asserted-by":"crossref","unstructured":"Sana Abdulbaqi Al-Qubati, Integrating Artificial Intelligence and Distributed Ledger Technology for Enhanced Cybersecurity: Opportunities and Challenges, in 2025 International Conference on Innovation in Artificial Intelligence and Internet of Things (AIIT) 1 (IEEE 2025), https:\/\/doi.org\/10.1109\/AIIT63112.2025.11082902.","DOI":"10.1109\/AIIT63112.2025.11082902"},{"key":"ref2","doi-asserted-by":"crossref","unstructured":"Dlovan Wrya Hamad Ameen, AI-Driven Secure Audit Trails for Financial Compliance Using Immutable Blockchain Logs, in 2025 3rd International Conference on Cyber Resilience (ICCR) 1 (IEEE 2025), https:\/\/doi.org\/10.1109\/ICCR67387.2025.11292506.","DOI":"10.1109\/ICCR67387.2025.11292506"},{"key":"#cr-split#-ref3.1","unstructured":"See Regulation (EU) 2024\/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), arts. 12, 15, 2024 O.J. (L 1689) 1"},{"key":"#cr-split#-ref3.2","doi-asserted-by":"crossref","unstructured":"Sanjay Goel & Gurvirender Tejay, Editorial: Are We Ready for Auditing AI-Based Systems?, 2 Org. Cybersecurity J.: Prac., Process & People 77 (2022), https:\/\/doi.org\/10.1108\/ocj-08-2022-037.","DOI":"10.1108\/OCJ-08-2022-037"},{"key":"ref4","doi-asserted-by":"crossref","unstructured":"Sai Srujan Gutlapalli, Commercial Applications of Blockchain and Distributed Ledger Technology, 4 Eng'g Int'l 89 (2016), https:\/\/doi.org\/10.18034\/ei.v4i2.653.","DOI":"10.18034\/ei.v4i2.653"},{"key":"ref5","doi-asserted-by":"crossref","unstructured":"See The Information Technology Act, 2000, \u00a7\u00a7 43A, 66D, No. 21, Acts of Parliament, 2000 (India) (\u00a7 43A to be omitted by the Digital Personal Data Protection Act, 2023, \u00a7 44(2)(a), with effect eighteen months after Nov. 13, 2025); Tanvir Kaur & Jaskaran Singh, Regulating AI in India: A Comparative Analysis with International Standards, 21 Econ. Sci. 595 (2025), https:\/\/doi.org\/10.69889\/ksaa2139.","DOI":"10.69889\/ksaa2139"},{"key":"#cr-split#-ref6.1","unstructured":"Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95\/46\/EC (General Data Protection Regulation), art. 17, 2016 O.J. (L 119) 1"},{"key":"#cr-split#-ref6.2","doi-asserted-by":"crossref","unstructured":"see also Diana Dimitrova, Right to Rectification or Erasure of Personal Data and Restriction of Processing, in The EU Law Enforcement Directive (LED): A Commentary 293 (Eleni Kosta & Franziska Boehm eds., 2024), https:\/\/doi.org\/10.1093\/law\/9780192855220.003.0016 (discussing the parallel right under Article 16 of the Law Enforcement Directive).","DOI":"10.1093\/law\/9780192855220.003.0016"},{"key":"ref7","unstructured":"The Digital Personal Data Protection Act, 2023, \u00a7\u00a7 6(4)\u2013(6), 8(7)(a), 12(3), No. 22, Acts of Parliament, 2023 (India). Sections 6(1)\u2013(8), 8 and 12 come into force eighteen months after November 13, 2025. See Notification G.S.R. 843(E), Gazette of India, Extraordinary, pt. II sec. 3(i) (Nov. 13, 2025) (India)."},{"key":"ref8","doi-asserted-by":"crossref","unstructured":"T. S\u00e9rgio Cabral, Forgetful AI: AI and the Right to Erasure Under the GDPR, 6 Eur. Data Prot. L. Rev. 378 (2020), https:\/\/doi.org\/10.21552\/edpl\/2020\/3\/8.","DOI":"10.21552\/edpl\/2020\/3\/8"},{"key":"ref9","doi-asserted-by":"crossref","unstructured":"Karun Sanjaya & Abhishek Benedict Kumar, AI, Blockchain, and the Future of Evidentiary Electronic Records, in Legal and Regulatory Perspectives on Electronic Records as Evidence 249 (Cathrine Nengomasha ed., IGI Global Sci. Publ'g 2025), https:\/\/doi.org\/10.4018\/979-8-3373-3023-5.ch010.","DOI":"10.4018\/979-8-3373-3023-5.ch010"},{"key":"ref10","doi-asserted-by":"crossref","unstructured":"Eugenia Politou, Efthimios Alepis, Maria Virvou & Constantinos Patsakis, The General Data Protection Regulation, in Privacy and Data Protection Challenges in the Distributed Era 13 (Springer 2021), https:\/\/doi.org\/10.1007\/978-3-030-85443-0_3.","DOI":"10.1007\/978-3-030-85443-0_3"},{"key":"ref11","doi-asserted-by":"crossref","unstructured":"Sushmita Ruj, Zero-Knowledge Proofs for Blockchains, in 2024 54th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks: Supplemental Volume (DSN-S) 67 (IEEE 2024), https:\/\/doi.org\/10.1109\/dsn-s60304.2024.00028.","DOI":"10.1109\/DSN-S60304.2024.00028"},{"key":"ref12","doi-asserted-by":"crossref","unstructured":"Di Zhang, Junqing Le, Xinyu Lei, Tao Xiang & Xiaofeng Liao, Exploring the Redaction Mechanisms of Mutable Blockchains: A Comprehensive Survey, 36 Int'l J. Intelligent Sys. 5051 (2021), https:\/\/doi.org\/10.1002\/int.22502.","DOI":"10.1002\/int.22502"},{"key":"ref13","doi-asserted-by":"crossref","unstructured":"Efat Fathalla, Chonggang Wang, Xu Li, Robert Gazda & Hongyi Wu, Redactable Distributed Ledgers: A Survey, 2 Distributed Ledger Techs.: Rsch. & Prac. 1 (2023), https:\/\/doi.org\/10.1145\/3596224.","DOI":"10.1145\/3596224"},{"key":"ref14","doi-asserted-by":"crossref","unstructured":"Benjamin J. Keele, Note, Privacy by Deletion: The Need for a Global Data Deletion Principle, 16 Ind. J. Global Legal Stud. 363 (2009), https:\/\/doi.org\/10.2979\/gls.2009.16.1.363.","DOI":"10.2979\/gls.2009.16.1.363"},{"key":"ref15","doi-asserted-by":"crossref","unstructured":"Loveth A. Ebong & Gertrude Fischer, Cloud Security Using Crypto-Shredding for Secure Data Deletion: A Reduction in Cyber Security Risks, 31 Global J. Pure & Applied Sci. 683 (2025), https:\/\/doi.org\/10.4314\/gjpas.v31i4.6.","DOI":"10.4314\/gjpas.v31i4.6"},{"key":"ref16","unstructured":"The Digital Personal Data Protection Act, 2023, \u00a7\u00a7 2(i), 8(7)(a), 12(3), No. 22, Acts of Parliament, 2023 (India). On the commencement of sections 8 and 12, see supra note 7."},{"key":"ref17","doi-asserted-by":"crossref","unstructured":"See Joanna Kulesza, Right to Be Forgotten in the Global Information Economy, in Comparative Privacy and Defamation 216 (Andr\u00e1s Koltay & Paul Wragg eds., Edward Elgar Publ'g 2020), https:\/\/doi.org\/10.4337\/9781788970594.00021.","DOI":"10.4337\/9781788970594.00021"},{"key":"ref18","doi-asserted-by":"crossref","unstructured":"Ama Oduma Annan, Data Privacy Governance Models for Cross-Border Digital Platforms, 3 Int'l J. Multidisciplinary Rsch. & Growth Evaluation 949 (2022), https:\/\/doi.org\/10.54660\/.ijmrge.2022.3.6.949-964.","DOI":"10.54660\/.IJMRGE.2022.3.6.949-964"},{"key":"ref19","doi-asserted-by":"crossref","unstructured":"Khaled Fattah & Basma Mohamed, The Role of Law in Addressing the Risks of Using Artificial Intelligence, 12 Int'l J. Sci., Tech. & Soc'y 151 (2024), https:\/\/doi.org\/10.11648\/j.ijsts.20241205.12.","DOI":"10.11648\/j.ijsts.20241205.12"}],"container-title":["International Journal of Law Management &amp; Humanities"],"original-title":[],"link":[{"URL":"https:\/\/ijlmh.com\/article\/download\/immutability-privacy-paradox-ai-governance\/1497","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ijlmh.com\/article\/download\/immutability-privacy-paradox-ai-governance\/1498","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ijlmh.com\/article\/download\/immutability-privacy-paradox-ai-governance\/1497","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,25]],"date-time":"2026-10-25T18:01:47Z","timestamp":1792951307000},"score":1,"resource":{"primary":{"URL":"https:\/\/ijlmh.com\/article\/view\/immutability-privacy-paradox-ai-governance"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10,25]]},"references-count":21,"journal-issue":{"issue":"V","published-online":{"date-parts":[[2026,9,1]]}},"URL":"https:\/\/doi.org\/10.63108\/ijlmh.13094","relation":{},"ISSN":["2581-5369"],"issn-type":[{"value":"2581-5369","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,10,25]]}}}