DATA PROTECTION | EDPB proposed guidelines on processing of personal data through blockchain technologies

On 8 April 2025, the European Data Protection Board (EDPB) adopted Guidelines No. 02/2025 (Guidelines), which clarify how the GDPR applies to personal data processing through blockchain systems. The Guidelines explain how different blockchain architectures affect the attribution of roles under GDPR, which must be assessed early on in order to determine who qualifies as controller or processor.

Storing personal data on-chain should be avoided unless necessary. Where this is unavoidable, organisations should apply privacy-enhancing techniques and organisational safeguards. The Guidelines provide practical examples to support data minimisation.

The Guidelines also addresses how blockchain affects data subject rights – particularly rectification and erasure – and stresses the need for a data protection impact assessment (DPIA) prior to deployment. Annex A includes a checklist to guide this process. The Guidelines are open for public consultation until 9 June 2025.

Newsletter n. 107 – May 2025