The European Data Protection Board (’EDPB’) has recently published its Guidelines 02/2025 on processing of personal data through blockchain technologies which analyse the challenges posed by the technology on the lawful processing of personal data. The EDPB finds that certain characteristics of blockchain technology clash with the data protection principles enshrined in the GDPR and present practical problems for their effective application.
The Guidelines provide an overview of blockchain technology, and identify the key properties which create difficulties for GDPR compliance. The EDPB further provides recommendations to data controllers on how some of these difficulties should be addresses.
While not straying from the Board’s previously stated views on blockchain, the Guidelines are nevertheless useful for controllers as they outline the key considerations that should be considered when deciding to adopt blockchain in personal data processing flows.
Characteristics of blockchain technology
The Guidelines provide a brief technical explanation of the principle of operation of blockchain networks.
In short, the data protection Board defines ’blockchain’ as any technology which implements a distributed and persistent database, which lacks a centralised management, and is coordinated by the entities participating in it, through a set of pre-defined rules. Unpacking this dense definition, the Guidelines see blockchains as databases or ’ledgers’ which contain information – usually about transactions – organized in blocks. The validity of each block, and subsequently – of the data stored on the ledger, is verified by all participants in it, through an appropriate consensus mechanism.
Due to their nature, blockchains possess properties of significant relevance to data protection. Blockchains generally are:
- Distributed. The ledger is replicated between multiple participants, and conversely – stored in multiple locations. This means that a full copy of the blockchain is stored in every node, and at different locations, creating redundancy.
- Disintermediated – ensuring that all copies of the ledger are identical is done not by a single managing entity, but by participants in the network, through the blockchain’s consensus mechanism;
- Consistent and tamper-proof – it is not possible to delete or change data stored on the blockchain once validated;
- Transparent – access to the data is available to all participants on the network who can audit the data at their convenience.
While these properties are at the core of blockchain technology’s value proposition – they allow a high-trust decentralised system of recording transactions, the EDPB has found them to be a significant difficulty to the application of data protection principles.
Personal data on the blockchain
Blockchains contain two general sets of information, both of which could contain personal data – transaction metadata, and payload.
Metadata
Transaction metadata includes identifiers of both parties involved – their unique identifiers or public keys. Public keys can be personal data, if they can be referenced with other available data to identify an individual. This is particularly the case when AML/KYC data is concerned, as well as for transactions following Travel Rule requirements set in Regulation (EU) 2023/1113.
On most blockchains, the identifiers are always visible to every participant in the chain.
Payload
The payload is the transaction’s content data – it can be an amount, an item purchased, a smart contract, etc. The payload can contain other data, apart from the transaction information, and is stored on the blockchain. As such, payload information can also contain personal data.
Technical measures to restrict access to personal data
As all data on the blockchain is, by definition publicly accessible to all participants in the network, storing personal data on it in plaintext is strongly discouraged. The EDPB looks at several mechanisms to limit or restrict access, and to allow for the eventual deletion or anonymisation of personal data on the blockchain.
The Encryption of personal data is done through the application of encryption algorithms based around a private key. The encrypted data is readable only through the use of the corresponding private key. While this allows the masking of personal data, the data itself is not changed, and remains personal data. The breaking of the encryption algorithm used is a matter of technological development and time, and thus erasing the encryption key is not an irreversible anonymisation of the data.
Hashing is another suggested technical measure. It consists of storing only a salted hash of the original data on the blockchain. The difference here is that the personal data itself is stored off-chain, as is the key (or ’salt’) which associates the hash with the data. In essence, the hash stored on the blockchain is only a proof of existence and identity of the original data, which is only usable to persons holding the data and the secret key – obtaining the original data with only the hash is not possible. The EDPB points out that the hash is still considered personal data, and the GDPR applies to its processing. Hashing also permits the effective erasure of personal data, as when the original data and key are securely deleted, the hash would not be linkable to an individual. While the advantage of hashing is that personal data is not stored directly on the blockchain, the off-chain storage requires a separate system with its own security and compliance risks.
The method actually suggested by the EDPB is storing only a Cryptographic commitment on the blockchain. A cryptographic commitment is a sealed promise about the content of the information (or personal data), which is stored separately, off-chain. The Guidelines strongly suggest implementing this type of technical solution, as the erasure of the personal data makes the respective commitment unlinkable to an individual. The separate storage problem however, is still very much unresolved, as the actual personal data, while not stored on-chain, still needs to be properly secured, thus shifting the issue.
Roles in the processing
Multiple actors in a blockchain network could lead to problems identifying key roles in the context of personal data processing. It could be difficult to distinguish between participants acting as data controllers and those who are processing on behalf of a controller.
An important distinction needs to be made between permissioned and permissionless blockchains. The two types, as we will see below, have a different governance model, which in turn leads to significant implications for data processing compliance.
In a permissioned blockchain, a single authority gives actors permission to participate in the network by reading, writing or creating blocks. Permissioned blockchains are private, insofar as the approval process by design is a form of vetting by the central authority. This architecture allows for a clear allocation of responsibilities which is why the EDPB strongly suggests that data controllers looking at blockchain technology as a means of processing personal data, should prefer using permissioned blockchains to do so.
The Guidelines stop short of a general guidance on when nodes are considered controllers or processors – the EDPB refers back to its Guidelines on the concepts of controller and processor, and advises that specific assessment should be carried out on a factual basis.
Public permissionless blockchains are open for anyone to participate, which makes determination of responsibilities difficult. Nodes on public blockchains can carry out processing activities, and should be qualified as controllers or joint controllers where they have decisive influence on the determination of purposes the processing activities.
Principles of the GDPR and the Blockchain
The principles are set forth in Article 5 of the GDPR, and are at the basis of all obligations of data controllers, the rights of individuals, and inform the oversight powers of supervisory authorities. They are not negotiable, as in all processing of personal data should follow the principles to be considered compliant.
The issue arises when the data protection principles meet the reality of new technologies such as blockchain. More specifically, the EDPB has identified significant problems with the practical application of some data protection principles:
Purpose limitation Personal data should not be processed for purposes other than those for which it was collected. This is a problem due to the autonomy of individual nodes on the blockchain and the lack of intermediation. Relationships between participants cannot easily be governed by a contract, and it is possible for individual nodes to use personal data stored on the blockchain for their own purposes (e.g. in the case of forking).
Data minimisation The unlimited persistence of the blockchain and the multiple identical copies present a significant challenge to the application of the data minimisation principle.
Data Accuracy The immutability of data on the blockchain makes it almost impossible to correct or amend any personal data already committed to the chain.
Storage limitation Perhaps the most significant barrier to compliance, the storage limitation principle is particularly difficult to observe, due to deletion of data being practically impossible. If actual personal data is stored on-chain, it would be nearly impossible to comply with the principle if the retention period is not the same as the complete lifetime of the blockchain.
International Data Transfers
Another significant issue is that blockchains, especially public permissionless ones, contain geographically dispersed nodes, often leading to cross-border transfers of personal data.
It is difficult, if not impossible, to implement appropriate safeguards for each node on a public network, although the EDPB advises controllers to ensure that nodes on permissioned blockchains should be bound by the EU Standard Contractual Clauses before granting them any permissions.
Data Protection Impact Assessment
The Guidelines instruct data controllers to carry out a Data Protection Impact Assessment (’DPIA’) before initiating any processing activities using blockchain technology.
The DPIA should consider all the risks to the rights and freedoms of individuals inherent to blockchain technology, and consider appropriate measures to address or mitigate them.
The measures considered should ensure the application in full of the data protection principles, and guarantee the effective exercise by data subjects of their rights.
Notably, the EDPB recommends that a DPIA should be carried out on an ongoing basis in cases where the data controller does not exercise control over the blockchain infrastructure such as when using public permissionless networks.
Recommendations
While of limited practical value, the Guidelines do provide some concrete recommendations.
The EDPB emphasises that storing personal data directly (even if encrypted) on the blockchain should be avoided. Doing so would make its secure erasure nearly impossible, and conflict with the data minimisation and storage limitation principles.
If controllers decide to implement blockchain technology for their data processing activities, this should be done predominantly using private permissioned blockchains, with public permissionless ones being strongly advised against.
The EDPB further advises that a DPIA should be carried out in all cases of planned processing using blockchain technology, and all identified risks and potential shortcomings should be addressed at the design stage, prior to the commencement of any processing activities. As the Guidelines point out that providing a working mechanism for erasure of personal data, for example, would not be possible at a later point.
Conclusion
The main takeaway of the Guidelines is that the EDPB views blockchain as a fundamentally high-risk technology when it comes to personal data protection.
While it does provide some benefits, particularly in ensuring data integrity and security due to its immutability and distributed nature, these same properties of blockchain present significant challenges to the compliant processing of personal data.
If a general rule is to be distilled from the Guidelines, it is to avoid using blockchain for processing of personal data when possible, and, where it is necessary, to employ private permissioned blockchains rather than a premissionless architecture.
Permissioned blockchains present their own set of challenges, particularly in ensuring their security and integrity, due to their usually more centralized nature leading to a potential single point of failure (cite). Therefore, controllers exploring the potential use of the technology for handling personal data should carefully consider all risks.
The PV Legal team has a long-standing experience with blockchain technology and personal data protection. Contact us now to make sure your data processing is fully compliant.