INTER-ORGANIZATIONAL EXCHANGE OF CONFIDENTIAL PERSONAL DATA BASED ON PERMISSIONED BLOCKCHAIN

The article addresses the issue of ensuringconfidential exchange of personal data in inter-organizationalinformation systems under conditions of increasing digitalinteraction between public and private sector entities. It is notedthat centralized models for processing and exchanging personaldata fail to provide an adequate level of protection againstunauthorized access, transaction tampering, and do not ensuresufficient transparency of data operations. These limitationshinder full compliance with regulatory requirements, particularlythe provisions of the General Data Protection Regulation(GDPR), ISO/IEC 27001 and 27701 standards, as well asnational legislation on information protection. The study substantiates the feasibility of using a permissioned blockchain as the architectural basis forimplementing a secure, decentralized exchange of personal datawith guaranteed access control, transaction audit, and dataimmutability. A conceptual model of the information system isproposed, involving smart contracts for managing data subjectconsent, access control, and the integration of the InterPlanetaryFile System (IPFS) for robust off-chain data storage. The modelalso includes the use of Zero-Knowledge Proof (ZKP) cryptographic mechanisms and behavioral verification criteriafor transactions. Particular attention is given to risk analysis associated withpersonal data processing in inter-organizational environments, and to the application of supplementary protection tools—suchas masking, pseudonymization, and data perturbation—tomitigate potential losses in the event of data leakage. A set oftechnical and organizational compliance criteria withinternational and national information security standards isoutlined. The aim of this research is to design an architectural modelfor inter-organizational personal data exchange based onpermissioned blockchain that ensures confidentiality, integrity, controlled access, and regulatory compliance in the field ofinformation protection.