Reading Time: 2 minutes
- The EDPB has launched sleek methods clarifying how blockchain abilities must follow the GDPR
- Organisations had been entreated to lift some distance from storing internal most knowledge on-chain and undertake “privacy by make” tips
- The steering stresses that technical barriers can’t elaborate non-compliance with EU knowledge safety rules
The European Files Protection Board (EDPB) has issued sleek steering on how blockchain technologies prefer to be aligned with the Total Files Protection Legislation (GDPR). The methods, adopted on 8 April 2025 and now delivery for public consultation, tackle rising concerns over the compatibility of decentralized knowledge systems with traditional knowledge safety tips. The EDPB stresses that the immutability and decentralised nature of blockchain can’t be an excuse to ignore rights equivalent to rectification, erasure, or knowledge minimisation.
Blockchain vs. GDPR: An Ongoing Stress
Blockchain’s promise of tamper-proof, decentralised knowledge has lengthy clashed with the GDPR’s core necessities, especially spherical the factual to be forgotten and the notion of files minimisation. “Whereas blockchain affords integrity and availability, these advantages include queer privacy risks,” the EDPB states in its document. Notably, it warns that “technical impossibility can’t be invoked to elaborate non-compliance with GDPR necessities.”
The methods warning in opposition to storing internal most knowledge straight on-chain, even in encrypted or hashed beget, as a result of the challenges of deleting such knowledge later. As a exchange, organisations are advised to retailer internal most knowledge off-chain and exhaust on-chain references equivalent to cryptographic commitments or hashes that discontinue no longer enable identification.
Purposeful Steps and Governance
The EDPB units out 16 key ideas, together with the need for a Files Protection Impact Review (DPIA) before any blockchain deployment that entails internal most knowledge. Controllers are entreated to elaborate the utilization of blockchain as “essential and proportionate,” and to doc their picks relating to architecture, storage, and governance.
Permissioned blockchains—where get right of entry to is limited and roles are clearer—are hottest over public, permissionless ones tackle Bitcoin or Ethereum. This constructing enables better allocation of GDPR responsibilities amongst contributors and helps maintain safety and believe. “Organisations must tranquil most effective explore public blockchains if there are properly-justified causes,” the document advises.
A Demand Technological Restraint
In cases where the GDPR and blockchain are essentially misaligned, the EDPB is evident: don’t exhaust blockchain. The document concludes that “whether it’s miles no longer that you would possibly per chance well be focus on of to enact the essential level of safety acceptable to the risk whereas the exhaust of blockchain, controllers must tranquil no longer utilise blockchain solutions.”
With the increasing adoption of blockchain in sectors tackle finance, logistics, and health tech, the EDPB’s methods would possibly per chance well fair encourage as a turning level—reminding builders and companies that technological innovation must tranquil operate at some level of the factual framework of human rights and knowledge safety.
