Compliance mapping

From obligation to capability, with honest status.

Each requirement below is mapped to the EVstring capability that supports it and marked available, in development or roadmap. EVstring helps operators meet obligations; responsibility for compliance stays with the operator.

Last reviewed: 2 October 2026 · See also global regulations

Available: Built and working in the current platform.
In development: In the committed build plan, not yet released.
Roadmap: Planned extension; not yet scheduled for release.

20
Available
1
In development
4
Roadmap

Identity, carrier and access tiers

How a battery is identified, how its passport is reached and who sees what.

Requirement	Legal basis	EVstring capability	Status
Unique identifier per battery	EU Art. 77; CN digital ID; IN BPAN (draft); KR battery ID	Passport ID scheme (EVS-{MFR}-{YYYY}-{SERIAL}) with one on-chain token per battery; duplicates rejected by the contract	Available
Data carrier (QR code) resolving to the passport	EU Art. 13(6), 77	Stable public URL per passport, printable as a QR code; scanned in the mobile app	Available
Public tier	EU Annex XIII(1)	Public passport page and API exposing only public fields	Available
Persons with a legitimate interest	EU Annex XIII(2)	Restricted tier for service centres, repurposers, recyclers, manufacturer and OEM, enforced by role guards	Available
Notified bodies, market surveillance, Commission	EU Annex XIII(3)	Regulator / auditor tier with read access to restricted and regulator-only records	Available
Standardised QR payloads	EU Art. 78 (open standards)	GS1 Digital Link compatible URLs	Roadmap

Passport data categories

Annex XIII content and equivalent national data points.

Requirement	Legal basis	EVstring capability	Status
General battery and manufacturer information	EU Annex XIII; CN traceability	Structured registration record with metadata hash anchored on-chain	Available
Material composition and hazardous substances	EU Annex XIII	Public summary fields per product type; detailed composition as restricted, encrypted documents	Available
Carbon-footprint declaration	EU Art. 7 (pending delegated act)	Declared value and lifecycle-stage split on the public passport, backed by a hashed certificate	Available
Recycled-content shares	EU Art. 8; IN BWMR	Recycled cobalt, lithium, nickel and lead shares with supporting documents	Available
Performance, durability and state of health	EU Art. 10, 14; UN GTR No. 22; Colorado SB26-003	Rated values at registration; SoH trend from telemetry with Merkle proofs	Available
Supply-chain due-diligence information	EU Arts. 47–53 (from 18 Aug 2027); US UFLPA evidence	Restricted due-diligence document type, encrypted, with on-chain hash	Available
Dismantling and safety information	EU Annex XIII(2)	Restricted documents for repairers and recyclers	Available
Lifecycle status (original, repurposed, remanufactured, waste)	EU Annex XIII; CN Interim Measures	On-chain lifecycle state machine with role and state checks	Available
Linked passport after repurposing	EU Art. 77	Second-life state on the same passport today; linked child passport planned	Roadmap
Material recovery at end of life	EU Art. 71, Annex XII; IN BWMR	Material-recovery records per battery (kg of Li, Co, Ni, Mn, Cu, Al) and regulator totals	Available

Data integrity and trust

Making records tamper-evident and actors accountable.

Requirement	Legal basis	EVstring capability	Status
Integrity and security of passport data	EU Art. 78	Canonical-JSON SHA-256 hashes anchored on a permissioned ledger; anyone can re-hash and compare	Available
Document verification	EU Art. 78; due-diligence evidence	Public verify endpoint: a modified file fails verification	Available
Telemetry integrity	SoH evidence	One Merkle root per time window on-chain; any reading provable	Available
Only authorised operators act (e.g. licensed recyclers)	IN BWMR; EU Art. 70; CN industry conditions	Role-based permissions in API and contract; a licensed-recycler verifiable credential gates recycling, and revoking it blocks the action at once	Available
Audit trail of actions and access	EU Art. 77; IN BWMR records	Immutable on-chain event history plus an audit log of user actions in the database	Available

Retention, availability and portability

Keeping records available for as long as the law and the business require.

Requirement	Legal basis	EVstring capability	Status
Passport availability over the battery life	EU Art. 77–78	Ledger is the source of truth; the database can be rebuilt by indexer replay	Available
Resilience to a single operator failing	EU Art. 78 (decentralised storage permitted)	Multi-validator permissioned network operated by consortium members (one validator in the pilot environment today)	Roadmap
Configurable retention of personal data	GDPR Art. 5(1)(e); DPDP Act s. 8(7)	Account deletion on request; retention schedules for audit logs set per deployment	In development
Export in machine-readable form	EU Art. 78; regulator reporting	Documented REST API (OpenAPI); report exports for EPR returns	Roadmap

Data protection

Personal data never goes on-chain

Ledgers are immutable; privacy laws give people rights to correction and erasure. EVstring resolves the tension by design: the ledger holds hashes and states, personal data stays in stores where it can be changed or destroyed.

Immutable

Permissioned ledger

Passport identifiers and lifecycle states
Organisation addresses and roles
SHA-256 hashes of records and documents
Merkle roots of telemetry windows
VIN only as a salted hash

Never: names, emails, phone numbers, addresses, raw documents or raw telemetry.

Erasable

Relational database

User accounts and contact details
Audit logs of user actions
Vehicle identifiers (restricted tier)
Searchable mirror of on-chain events

Personal data lives here so it can be corrected, exported and deleted on request.

Crypto-shreddable

Encrypted document storage

Restricted documents encrypted with AES-256-GCM
One key per document, held outside the store
Only the hash and content address go on-chain

Deleting a document’s key renders every copy of the ciphertext unreadable.

EU / EEA · Regulation (EU) 2016/679

GDPR

Lawful basis for each purpose (Art. 6); controller–processor contract (Art. 28).
Rights to access, rectification, erasure, restriction, portability and objection (Arts. 15–21).
Data protection by design and by default (Art. 25); security of processing (Art. 32).
Breach notification to the supervisory authority within 72 hours where required (Art. 33).
Transfers outside the EEA only with adequacy, SCCs or another Chapter V tool.

Personal data is kept off-chain so erasure and rectification are possible. Customers act as controllers; EVstring acts as processor under a DPA.

India

DPDP Act 2023 and DPDP Rules 2025

Processing on consent or for certain legitimate uses; itemised notice in clear language.
Data principal rights: information, correction and erasure, grievance redressal and nomination.
Consent managers registered with the Data Protection Board (provisions effective November 2026).
Reasonable security safeguards and breach intimation to the Board and affected principals.
Most obligations apply 18 months after the Rules were notified on 14 November 2025, unless shortened.

Deletion and correction are handled in the database; on-chain records contain no personal data. A grievance contact is published in the privacy policy.

California, United States

CCPA as amended by CPRA

Applies to for-profit businesses meeting statutory thresholds, including for B2B and employee data since 1 January 2023.
Rights to know, delete, correct, and opt out of sale or sharing; limits on sensitive personal information.
Service-provider contracts restricting use of personal information.

EVstring does not sell or share personal information for cross-context behavioural advertising and acts as a service provider to customers.

China · Personal Information Protection Law

PIPL

Legal basis such as consent or contract necessity; separate consent for certain processing.
Personal information protection impact assessments for higher-risk processing.
Cross-border transfers via CAC security assessment, standard contract or certification, unless exempt.

Region-configurable deployment allows data generated in China to be stored in China; on-chain data contains no personal information.

How specific data is handled
Data	Personal?	Where it lives
Battery specs, composition, carbon, lifecycle states	No	Database, with hashes and states on-chain
Organisation addresses and roles	Business data	On-chain
User names, emails, phone numbers, password hashes	Yes	Database only (erasable)
Vehicle identification number (VIN)	Potentially	Database (restricted tier); on-chain only as a salted hash. Deleting the salt makes the hash unlinkable
Service photos and restricted documents	Possibly	Encrypted storage with per-document keys; hash on-chain; crypto-shredding on erasure
Telemetry	Could become personal if linked to a driver	No GPS or location collected; only Merkle roots on-chain

Crypto-shredding of restricted documents is available: destroying a document's key makes every stored copy unreadable, while its on-chain fingerprint remains. The European Data Protection Board has issued guidelines on processing personal data through blockchain technologies (Guidelines 02/2025), which recommend keeping personal data off-chain where possible; EVstring follows that approach.