The paradox

Every EU member state must issue a digital identity wallet supporting selective disclosure. A user proving residency, age, or a professional credential must do so without revealing unrelated attributes.

How zkRune helps

Off-the-shelf circuits for age, membership, credential, and signature attestations — directly aligned with the Architecture Reference Framework's ZKP guidance. Drop into a wallet, attestation issuer, or relying-party verifier.

The paradox

Article 12(4) mandates retention of every input that led to a match for at least six months. GDPR Article 5(1)(c) mandates data minimisation. The two binding obligations directly contradict each other for Annex III systems.

How zkRune helps

Each decision becomes a tamper-evident Groth16 proof — fully verifiable by a market-surveillance authority, containing no raw input, under 200 bytes per record. Anchored on Solana / Ethereum / Sui mainnet.

The paradox

Online platforms accessible to minors must implement appropriate measures to ensure a high level of privacy, safety, and security. Standard age-verification (collect government ID) is itself a GDPR liability and a breach target.

How zkRune helps

Drop-in age proof generated in the user's browser. Your service receives only the cryptographic assertion that age >= threshold — never the underlying birthdate. Same widget covers UK Online Safety Act requirements.

The paradox

Ofcom enforcement is active and platforms are being named publicly for non-compliance. Storing government ID for age verification creates a parallel data-breach liability.

How zkRune helps

Privacy-preserving age verification mapped to Ofcom's 'highly effective' criteria. No PII retained server-side; proof artefact is the audit record.

The paradox

Crypto-asset service providers must perform KYC, beneficial-ownership screening, and travel-rule disclosures while honouring GDPR data-minimisation. Exchanges currently retain identity dossiers indefinitely as a default.

How zkRune helps

Proof of solvency, jurisdictional eligibility, and AML threshold compliance without retaining identity dossiers per customer. Composable with the existing balance-proof on-chain attestation path.

The paradox

Enhanced due diligence requires beneficial-ownership and PEP screening, but indefinite retention of EDD records is increasingly challenged under GDPR proportionality.

How zkRune helps

Cryptographic proofs that a counter-party was screened against an authoritative list at a moment in time, without retaining the list lookup or the full identity attributes.

The paradox

Financial entities and their ICT providers must report incidents and operational events with sufficient detail for regulators to assess systemic risk — without exposing customer data in shared incident reports.

How zkRune helps

Cryptographic proofs of incident-relevant facts (event ordering, identity attestations, decision paths) that supervisors can independently verify without seeing the underlying customer records.

The paradox

Multi-factor authentication and transaction-risk analysis must be auditable, but the underlying behavioural and biometric signals are exactly the data buyers want minimised.

How zkRune helps

Risk-attribute proofs (device binding, balance threshold, behavioural pattern membership) that satisfy SCA exemption criteria without retaining the raw signals.

The paradox

Essential and important entities in critical sectors must report security events and demonstrate continuous risk management. Reporting templates require attribute-level detail that conflicts with data-minimisation.

How zkRune helps

Cryptographic attestations of compliance actions (access controls, vendor audits, incident-response steps) verifiable by national CSIRTs without the entity exposing raw operational data.

The paradox

Personal data must be adequate, relevant, and limited to what is necessary. Every other regulation in this list demands more logging, more retention, more attestation — pulling against this baseline.

How zkRune helps

Privacy by architecture: proofs travel, personal data does not. Where every other vendor is solving the tension with policy, zkRune solves it structurally — there is no raw PII to delete because it was never collected server-side.