This guide is general education about your data rights, not legal advice. Data protection and anti-money laundering rules differ by country and change over time, so check the rules where you live and the exchange's own privacy policy.
If you have ever uploaded a passport to a crypto exchange, this guide is for you. By the end you will know where copies of that file sit, how to ask for them, how to get them deleted when the law allows, and how to make leaked data far less useful to the people who buy it.
The whole guide on one page. Download the privacy lockdown checklist (PNG) and work through one item a day.
Can you delete your KYC data from a crypto exchange?
Yes, but not straight away. Anti-money laundering law overrides your right to erasure for as long as the exchange is required to keep the records, which in the UK and EU is five years after the business relationship ends. Once that period runs out, an erasure request has to be honoured.
The detail that matters is when the clock starts. The UK's Money Laundering Regulations 2017 (regulation 40) and the EU's anti-money laundering directive (Article 40) both count five years from the end of the relationship, and the EU's new anti-money laundering regulation keeps the same five years when it applies from 2027. In the US, Bank Secrecy Act rules set a five-year retention period for the records they cover. The EU's General Data Protection Regulation (GDPR) says so directly: the right to erasure in Article 17 does not apply where keeping data is needed to meet a legal obligation.
Exchanges say this openly. Coinbase's own privacy data request FAQ says data it must keep under regulation "will not be deleted until such requirements have been met." The practical consequence is simple: an account you no longer use but leave open keeps your passport on file with no end date. Closing it is what starts the countdown.
Illustrative timeline. The five-year retention clock in UK and EU rules only starts when the relationship ends, so every year a dead account stays open is another year your ID is on file.
Where is your KYC data stored?
Your KYC data is stored in more places than the exchange you sent it to. A single identity check usually creates copies in four places, and each one needs a different response.
- The exchange itself keeps your ID document, selfie, address and full transaction history.
- Its vendors receive whatever the exchange shares with them: identity verification firms, analytics tools, email platforms and customer support software.
- Leaks put copies in criminal hands that no request can reach.
- Data brokers combine your address, phone number and relatives from public and bought records, and sell them to anyone who pays.
The record shows how each route plays out. In December 2020, data from Ledger's online shop was dumped publicly: 272,853 records with names, postal addresses and phone numbers, plus more than a million email addresses. In May 2025, Coinbase disclosed that criminals had bribed overseas support staff to hand over customer names, addresses, phone numbers and images of government ID; it told the Maine attorney general that 69,461 customers were affected. And on 27 October 2026, Coinbase said a security incident at Amplitude, an analytics vendor it uses, exposed "a small subset of Coinbase customer contact data", adding that "Coinbase has not had a data breach."
That last line is the lesson. You do not have to be hacked to be leaked. Your data only has to be somewhere. Our guide to what KYC is and what exchanges collect covers the check itself; the rest of this guide is about the copies it leaves behind.
What you can do depends on who holds the copy. Requests work on the exchange and its vendors; leaked copies can only be made less useful.
How do you find out which companies hold your ID?
Start with your own inbox, because almost every identity check leaves an email behind. Search for "verify your identity", "KYC", "passport", "proof of address" and "selfie". Every company that turns up is holding a file on you, including the apps you tried once in 2017 or 2021 and forgot about.
Write the list down: company, the email address you used, and whether the account is still open. Then put each email address into Have I Been Pwned, a free breach-search service, to see which known leaks it already appears in. A hit does not mean your ID document leaked, but it tells you which of your details are already circulating and which emails to treat with extra suspicion.
How do you ask an exchange for a copy of your data?
In the UK and EU you send a data subject access request, which is free and has to be answered within one month. Under GDPR Article 15 you are entitled to a copy of your personal data, the recipients or categories of recipient it has been shared with, and how long it will be kept. The UK regulator, the ICO, explains the process in its guide to getting copies of your information. Complex requests can be extended by up to two further months, but the company has to tell you why.
Email the privacy or data protection address in the exchange's privacy policy, from the email address on the account. Something this short works:
"Under Article 15 GDPR, please send me a copy of all personal data you hold about me, the names of every third party you have shared it with, and how long you will keep each category of data."
Ask for names, not just categories. Firms may answer with categories such as "analytics providers", but the names are how you learn which vendor holds a copy before it shows up in the news. In California, the California Consumer Privacy Act (CCPA) gives a similar right to know, with 45 days to respond and one possible 45-day extension. One catch: data covered by US financial privacy law (the Gramm-Leach-Bliley Act) is exempt from parts of the CCPA, so a US exchange may refuse some of the request.
How do you get an exchange to delete your data?
Close the account first, then ask for erasure. Sending an erasure request while the account is open achieves very little, because the exchange still needs your data to run the account and the retention clock has not started.
- Withdraw everything. Move coins to a wallet you control and fiat to your bank. Our guide to self-custody of Bitcoin covers the move.
- Export your history first. Download every transaction report the exchange offers before you close. Tax authorities can ask about disposals for years, and you will not be able to log in later. Our crypto record-keeping guide lists what to save.
- Close the account through the exchange's own settings or support form, and keep the confirmation email.
- Send an erasure request. Under GDPR Article 17, or the CCPA's right to delete in California, ask the exchange to erase everything it is not legally required to keep, and to stop using the rest for anything except that legal requirement.
- Ask for the end date. Ask what it will keep, under which law, and until when. Put the date in your calendar and send a short follow-up when it passes.
If an exchange in the UK or EU ignores you, the next step is a complaint to the data protection regulator, which is the ICO in the UK and the national authority in each EU country.
How do you stop exchanges sharing your data with vendors?
Opt out of marketing everywhere, and object to your data being used for analytics. Under GDPR Article 21 you can object to direct marketing at any time, and the company has to stop. You can also object to processing based on the company's "legitimate interests", which is where much analytics sits, and the company then has to stop unless it can show compelling grounds to continue.
In practice, check the privacy or data settings in the app first, since many exchanges let you switch off marketing and some tracking there. Then put the objection in writing in the same email as your access request. In California, the CCPA gives a right to opt out of the sale or sharing of personal information, usually through a "Do Not Sell or Share" link. Analytics vendors are exactly where the October 2026 Coinbase exposure happened, so fewer vendors holding your contact details means fewer places for the next one.
How do you get off people-search sites?
People-search sites and data brokers publish the details a criminal needs to turn a leaked email into a front door: your home address, phone number and relatives. Removing yourself does not touch exchange data, but it breaks the link between a leaked customer list and where you live.
Californians have the easiest route. The state's Delete Request and Opt-out Platform (DROP) sends one free deletion request to every registered data broker, and since 1 August 2026 brokers have to process those requests every 45 days. Everyone else has to do it site by site: search your full name plus your town, open each people-search result, and use the site's opt-out page. In the UK and EU, an Article 17 erasure request works against brokers too. Repeat the search every few months, because brokers re-add people from fresh records.
What should you do after a crypto exchange data breach?
Assume the leaked details will be used against you, and make them useless. You cannot delete a dump once it is out, but you can make sure your email, phone number and address no longer lead anywhere valuable.
| What leaked | What criminals try | What to do |
|---|---|---|
| Email address | Phishing that looks like your exchange | Move crypto accounts to a separate email or alias you use for nothing else |
| Phone number | SIM swaps and fake support calls | Set a port-out PIN or number lock with your carrier, and never use SMS for two-factor authentication |
| Home address | Fake letters, fake replacement devices, threats in person | Have hardware wallets delivered to a pickup point; never post what you hold or where you live |
| Account details | Calls "from security" about a suspicious login | Hang up and contact the exchange through its own app or website |
Use an authenticator app or a hardware security key for two-factor authentication on every exchange and email account. A message that knows your name, address and balance feels convincing, which is exactly why leaked data is valuable. No exchange will phone you to "secure your account", and nobody legitimate will ever ask for your seed phrase. Our guide to fake crypto support scams shows the scripts in detail, and if you are unsure about a message, members can ask our private Ask Crypto AI whether it matches a known scam before replying. More guides are in the Scams and Risk hub.
How do you stop creating new copies of your ID?
Sign up for fewer KYC services, and keep what you hold off them. Every new sign-up is another file, and every file is another vendor list you cannot see. Before verifying with a new platform, ask whether you will still use it in a year; if not, the convenience probably costs more than it saves.
Coins held in your own wallet do not come with a customer file at all. Keep exchange accounts to the one or two you actually use for buying and selling, withdraw to self-custody, and close the rest. For buying without handing over ID, our guide to no-KYC Bitcoin covers the peer-to-peer routes and the legal limits in different countries.
Frequently asked questions
Can I delete my KYC data from Coinbase?
Not immediately. Coinbase's privacy FAQ says data it must keep under regulation will not be deleted until those requirements have been met, and anti-money laundering rules in the UK and EU require five years from the end of the relationship. The practical route is to withdraw your funds, export your transaction history, close the account, then send an erasure request asking what will be kept and until when.
How long do crypto exchanges keep KYC data?
Usually at least five years. The UK's Money Laundering Regulations 2017 and the EU's anti-money laundering rules require identity and transaction records to be kept for five years after the business relationship ends, and US Bank Secrecy Act rules set a five-year period for the records they cover. Regulators can extend some periods. For an account that stays open, there is no end date at all.
Is a GDPR data request free?
Yes, in most cases. GDPR Article 12 says the first copy of your data must be provided free of charge, and the company has one month to respond, extendable by two further months for complex requests. It can charge a reasonable fee or refuse only if a request is manifestly unfounded or excessive, for example repeated requests for the same data. The UK GDPR works the same way.
What should I do if my exchange had a data breach?
Treat every call, text and email about your account as phishing, and contact the exchange only through its own app or website. Change your email password, switch two-factor authentication from SMS to an authenticator app or security key, and set a port-out PIN with your mobile carrier. Then send an access request asking exactly which of your data was exposed and who else holds it.
Does closing a crypto exchange account delete my data?
No. Closing the account starts the anti-money laundering retention period, but the exchange keeps your identity documents and transaction records until that period ends. After closing, send a separate erasure request so that anything not legally required is deleted now and the rest is deleted when the period runs out. Export your transaction history before you close, because you will lose access to it.
Can data brokers sell my crypto exchange data?
Exchanges do not normally sell KYC documents to data brokers, but brokers sell the details that make leaked exchange data dangerous: your home address, phone number and relatives. Removing yourself from people-search sites breaks the link between a leaked customer list and your front door. Californians can use the state's free DROP service; elsewhere, opt out site by site and repeat every few months.
Keep learning
- What Is KYC in Crypto? Know Your Customer Explained
- No-KYC Bitcoin in 2026: How to Buy, Swap, and Cash Out Without Handing Over Your ID
- Fake Crypto Support Scams: How the Con Works
- How to Self-Custody Bitcoin in 2026: The $100 Setup and the Next Steps Up
- Crypto Security Best Practices: Comprehensive Guide to Secure Crypto Assets in 2025
- More guides in the Scams and Risk hub
- Free headlines: the Learning Crypto news feed on Telegram
