## 4 Discussion
### Regulatory Implications  
Storing traceability data in the case of highly regulated sectors such as food and pharmaceuticals carries significant legal and regulatory implications that should be considered. In these industries, traceability is not just a best practice; it is often a legal requirement aimed at ensuring consumer safety and product integrity. Regulations such as the Food Safety Modernization Act (FSMA) in the United States [66] and the General Food Law in the European Union [67] mandate comprehensive traceability systems that allow for the tracking of products throughout the supply chain. These regulations require organisations to maintain detailed records of product origins, processing, and distribution, which must be readily accessible for audits and inspections. Failure to comply with these regulations can result in severe penalties, including fines, product recalls, and damage to brand reputation.  
Moreover, the storage and management of traceability data must adhere to data-protection laws, such as the General Data Protection Regulation (GDPR) in Europe. These laws impose strict requirements on how personal data are collected, stored, and processed, including the need for explicit consent from individuals whose data may be included in traceability records [68]. Organisations must ensure that their traceability systems are designed to protect sensitive information and comply with privacy regulations, which can complicate data-management strategies. This dual focus on traceability and data protection requires a careful balance, as organisations must be transparent about their data practices while also safeguarding consumer privacy.  
Note that off-chain data storage significantly enhances privacy in traceability systems by allowing sensitive information to be kept away from the blockchain, where all data are visible and immutable, specially in public blockchains. By storing sensitive traceability data off-chain, organisations can control access to this information, ensuring that only authorised parties can view or modify it. This approach minimises the risk of exposing sensitive data to unauthorised users or potential attackers, as the critical details are not permanently recorded on a public ledger. Additionally, off-chain storage can employ advanced encryption techniques, further safeguarding the data against breaches. By combining off-chain storage with cryptographic hashes stored on-chain, as discussed in this paper, the integrity and authenticity of data can be guaranteed while protecting individual privacy, thus balancing transparency with confidentiality in compliance with data-protection regulations.  
In addition to compliance with existing regulations, data ownership and liability may also be a concern. For instance, if traceability data are stored on a public blockchain, determining accountability in the event of a data breach or misinformation can be challenging. As a consequence, Oclear policies regarding data governance and liability must be defined to mitigate potential legal risks associated with the use of blockchain technology.  
Finally, the global nature of supply chains discussed above adds another layer of complexity to legal and regulatory compliance. Different countries have varying regulations regarding traceability, and organisations operating internationally must deal with diverse legal landscapes. This can lead to increased operational costs and the need for specialised legal expertise to ensure compliance across jurisdictions. Organisations must stay informed about regulatory changes and adapt their traceability systems accordingly to avoid legal pitfalls.