LGPD and Soulbound Tokens: are you ready to take back control of your data?

Brazil's LGPD gives people the legal right to know and decide how their personal data is processed, and Soulbound Tokens (SBTs) propose a technical way to keep credentials and reputation in a wallet that belongs to the individual. Together, law and technology point to a Web3 where digital identity stops being the property of platforms and returns to the hands of the person it describes.

Here we go: have you ever wondered who really owns and controls your personal data? The world already changed a few decades ago, and we are about to witness one of the biggest digital revolutions we have ever seen, one that can put power over our data back in our hands. In this article we explore how Brazil's General Data Protection Law (LGPD) and Vitalik Buterin's ideas about Soulbound Tokens meet.

Imagine a world where you can control and monetize your own data, where privacy and transparency are guaranteed and the value generated by your information flows straight back to you. That is what Vitalik Buterin, one of the founders of Ethereum, is trying to achieve with his Soulbound Token idea. At the same time, the LGPD sets clear rules in Brazil for how personal data is processed and used, giving individuals more control and protection.

Buterin, together with Puja Ohlhaver and E. Glen Weyl, published the 2022 paper Decentralized Society: Finding Web3's Soul. In it, the authors lay out their vision of a decentralized society (DeSoc) and the means to make it real. Their proposed solution? Something called Soulbound Tokens.

Combining these two approaches, legal protection on one side and technical innovation on the other, can lead to a future where people are more empowered and benefit directly from the use of their data. It is almost like leaving the Matrix: realizing that the system we live in was designed by others and choosing the pill that gives control back.

Soulbound Tokens are non-transferable digital identity tokens that represent the traits, credentials and achievements of a person or entity. They are issued by "Souls", which are wallets or accounts on a blockchain. A university, for example, would be a Soul that issues a diploma to your Soul, and that diploma cannot be sold or transferred.

A concrete example of this approach is the Binance Account Bound (BAB) token, launched by Binance in 2022 on BNB Chain. BAB is non-transferable, has no monetary value and works as digital proof that the user completed identity verification (KYC) at the exchange. According to Binance's documentation, protocols can use it for airdrops, to keep bots out of NFT mints and for DAO votes with a cap on voting power per person.

Note (Oct 2026): BAB is still active, with about 1.16 million holders, but it remains a pilot from a single issuer. Third-party use depends on each protocol, and the public link between a wallet and a KYC check is now also seen as a privacy risk.

• Educational records. Universities and schools can issue SBTs as digital certificates of course completion. These tokens can be easily verified and shared, simplifying credential checks.
• Job applications. Candidates can present their work history and professional certificates through SBTs issued by the companies and institutions where they worked, as verifiable and trustworthy proof.
• Health records. Health professionals could access records stored in SBTs, making it easier to share information between specialists and institutions, as long as the privacy and security of patient data are guaranteed.
• DAO governance. SBTs can assign voting power based on members' reputation and contributions, creating more democratic governance that is more resistant to Sybil attacks, where one person creates many fake identities.

The DeSoc authors themselves acknowledge the other side: a misused database of SBTs could be used to discriminate against groups or surveil people. That is why the proposal includes ways to hide or discard tokens, and this is where the LGPD speaks directly to Web3, by requiring purpose, consent and the right to deletion.

In his January 2022 essay Soulbound, Buterin sums up the idea: "Making more items in the crypto space 'soulbound' can be one path toward an alternative, where NFTs can represent much more of who you are and not just what you can afford."

The intersection between the LGPD and SBTs signals a promising future for assets, possession and ownership in the Web3 era. By combining legal protection with technological innovation, we can build an ecosystem where individuals are truly empowered by the use of their information in the digital economy.

Can an SBT be sold? No. By definition it is non-transferable: it stays bound to the wallet that received it.

Do SBTs replace the LGPD? No. The LGPD is a law and still applies to anyone processing personal data in Brazil. SBTs are a technical tool that can help meet principles such as transparency and control by the data subject, but they also create their own risks, since what goes onto a public blockchain is hard to erase.

Is Binance's BAB an SBT? Yes, Binance itself describes it as a Soulbound Token issued to users who completed identity verification.

We are heading toward a future where ownership and control of personal data can be returned to people. The LGPD and Buterin's ideas about SBTs are paving the way for a fairer, more decentralized data ecosystem, in which we will all be part of the new digital economy. So, do you believe we can hold the power over our data in our own hands?

Douglas Henrique, DOUVRAS Labs. Originally published on LinkedIn on January 15, 2024.

Brazil. Law No. 13,709 of August 14, 2018 (General Personal Data Protection Law). Planalto.

Ohlhaver, P.; Weyl, E. G.; Buterin, V. Decentralized Society: Finding Web3's Soul. SSRN, 2022. SSRN.

Buterin, V. Soulbound. vitalik.eth.limo, Jan 26, 2022. Link.

Exmundo, J. NFTs 2.0: How Soulbound Tokens Could Change Society as We Know It. nft now, 2022. Link.

Binance. Binance Account Bound Token: Introduction. Binance Open Platform. Link.