Last updated: October 27, 2026
You can ask a crypto exchange to delete your personal data — in the EU and UK under the GDPR "right to erasure", in California under the CCPA — but regulated exchanges are usually required by anti-money-laundering laws to keep KYC records, often for around five years after the account is closed, so ID documents typically can't be deleted right away. What you can do now: close unused accounts, request a copy of what they hold, ask them to delete everything not legally required, and stop creating new KYC accounts for simple coin-to-coin swaps — use no-account services like BTC → XMR instead.
- ~5 years typical AML retention after closing
- Right of access to see what they hold
- Right to erasure for non-required data
- 0 KYC data in no-account swaps
What exchanges keep — and why
| Data | Can be deleted on request? |
|---|---|
| ID documents, selfies, verification results | Usually not until the AML retention period ends |
| Transaction records | Usually not during retention |
| Marketing preferences, newsletters | Yes, stop immediately |
| Device data, analytics, cookies | Often yes |
| Data shared with partners for marketing | Often yes |
Retention periods differ by country — this is general information, not legal advice.
How to request deletion (step by step)
- Withdraw your funds to self-custody — moving off a KYC exchange.
- Request a copy of your data (GDPR access request) to see what they hold.
- Close the account through settings or support.
- Send a deletion request to their privacy or data-protection contact: ask to erase all data not required by law, and to confirm what is retained, why and until when.
- Keep the reply; follow up after the stated retention period ends.
- Complain to the data-protection authority if they ignore you (EU/UK).
Why it matters
Every stored ID scan is a liability: exchanges get breached, and leaked KYC data enables phishing, identity fraud and targeting — see what to do after an exchange breach and wrench attacks. Reducing the number of companies that hold your documents reduces your exposure for years.
Leave less behind from now on
- Use no-KYC swaps for coin-to-coin moves — no phone, no email, no registration.
- Keep one regulated account at most, if you need fiat access.
- Use a separate email and strong 2FA on what remains — 2FA for crypto.
Frequently asked questions
Can I make an exchange delete my KYC documents?
You can ask, but regulated exchanges usually must keep them for a legal retention period after the account closes. They should delete other data and confirm what they keep.
How long do exchanges keep KYC data?
Commonly around five years after the business relationship ends, depending on the country's AML law.
What is a GDPR access request?
A request asking a company to tell you what personal data it holds about you and how it uses it. Companies in the EU/UK must answer within about a month.
Does closing my account delete my data?
Not automatically. Send an explicit deletion request after closing, and ask what will be retained.
How can I avoid giving KYC data in the future?
For crypto-to-crypto swaps, use no-KYC instant exchanges that need no account or ID.
Swap without handing over ID: BTC → XMR, USDT → BTC or what KYC is. No account, no ID, no logs.