Method for providing data privacy in a private distributed ledger, comprising: a distributed application preparing a transaction payload for a private transaction, and encrypting the transaction payload using a symmetric key; the distributed application sending (200,216) a payload storage message comprising the encrypted transaction payload, a hash digest of the encrypted transaction payload and the symmetric key encrypted with the public keys of parties to the transaction to a transaction key manager; the transaction key manager storing the hash and the encrypted transaction payload, wherein the encrypted transaction payload is stored off-chain in a local database managed by the transaction key manager; the distributed application sending a pending transaction comprising the hash digest to a first node in a plurality of nodes; one of the plurality of nodes proposing a block comprising the pending transaction to the other nodes; each node validating the pending transaction in the block, the validating comprising identifying the pending transaction as a private transaction; a requesting node of the plurality of nodes sending a transaction payload request message with the hash digest to the transaction key manager associated with the node; the transaction key manager associated with the requesting node receiving and processing the transaction payload request to determine if the requesting node is a party to the transaction; and the transaction key manager associated with the requesting node returning the encrypted transaction payload and the encrypted symmetric key to the requesting node in response to the requesting node being a party to the transaction, and the requesting node decrypting the encrypted symmetric key and the transaction payload, and sending for execution, or the transaction key manager returning an indication to the node that the transaction is private in response to the requesting node not being a party to the transaction. a distributed application preparing a transaction payload for a private transaction, and encrypting the transaction payload using a symmetric key; the distributed application sending (200,216) a payload storage message comprising the encrypted transaction payload, a hash digest of the encrypted transaction payload and the symmetric key encrypted with the public keys of parties to the transaction to a transaction key manager; the transaction key manager storing the hash and the encrypted transaction payload, wherein the encrypted transaction payload is stored off-chain in a local database managed by the transaction key manager; the distributed application sending a pending transaction comprising the hash digest to a first node in a plurality of nodes; one of the plurality of nodes proposing a block comprising the pending transaction to the other nodes; each node validating the pending transaction in the block, the validating comprising identifying the pending transaction as a private transaction; a requesting node of the plurality of nodes sending a transaction payload request message with the hash digest to the transaction key manager associated with the node; the transaction key manager associated with the requesting node receiving and processing the transaction payload request to determine if the requesting node is a party to the transaction; and the transaction key manager associated with the requesting node returning the encrypted transaction payload and the encrypted symmetric key to the requesting node in response to the requesting node being a party to the transaction, and the requesting node decrypting the encrypted symmetric key and the transaction payload, and sending for execution, or the transaction key manager returning an indication to the node that the transaction is private in response to the requesting node not being a party to the transaction. the transaction key manager associated with the requesting node returning the encrypted transaction payload and the encrypted symmetric key to the requesting node in response to the requesting node being a party to the transaction, and the requesting node decrypting the encrypted symmetric key and the transaction payload, and sending for execution, or the transaction key manager returning an indication to the node that the transaction is private in response to the requesting node not being a party to the transaction.