Skip to content
All about technology. — All about data & cloud computing.

Board of European Data Protection Places Blockchain at GDPR Decision Point

Public blockchain technology is viewed as no exception to privacy laws by the European Data Protection Board. This perspective, expressed in their April 2025 guidelines, poses a direct conflict between public blockchains and the European Union's General Data Protection Regulation.

,   and  Administrator
3 min read
Data Protection Authorities Debate GDPR Implications for Blockchain Technology at Pivotal Juncture
Data Protection Authorities Debate GDPR Implications for Blockchain Technology at Pivotal Juncture

Board of European Data Protection Places Blockchain at GDPR Decision Point

In the realm of public, permissionless blockchain networks, the European General Data Protection Regulation (GDPR) compliance responsibility primarily rests with front-end actors such as wallets and decentralized applications (dApps), which choose to process personal data. These actors are classified as data controllers under GDPR, while the blockchain's lower-layer infrastructure, including consensus nodes, validators, and data availability nodes, typically handle only encrypted, pseudonymized, or anonymized data, placing them in the role of data processors or outside the scope of GDPR entirely.

This role differentiation is crucial due to the highly decentralized nature of public permissionless blockchains, which makes it unclear who the "controller" is when considering the overall network. To minimize exposure and preserve compliance, personal data should ideally be kept off-chain or transformed before reaching the blockchain's execution and consensus layers.

Validators and miners maintain the network's integrity but do not make decisions about personal data processing purposes, so GDPR controller duties are not directly assigned to them. This releases them from full compliance liability.

Privacy-preserving techniques such as zero-knowledge proofs, homomorphic encryption, and modular blockchain architecture contribute to reducing personal data directly handled on-chain.

The European Data Protection Board (EDPB) guidelines support a privacy-by-design approach, emphasizing that entities using blockchain technology must assess whether personal data processing is necessary on-chain and prefer off-chain solutions where possible, recording compliance measures carefully.

In practice, the decentralized and permissionless nature of public blockchains often makes forming a legal consortium for compliance difficult or impractical. Therefore, focusing GDPR compliance obligations on the software and application layer (wallets, dApps) is the prevailing and emerging approach.

This allocation aligns with efforts to reconcile blockchain's decentralization and immutability with GDPR principles, preserving user privacy while maintaining network security. The European Blockchain Association proposes a privacy-preserving design that keeps personal data off-chain wherever possible, storing identifiable data off-chain in user-facing services.

This approach does not require new legislation but rather a thoughtful application of GDPR's existing principles in this new context. The concept of a 'data controller' in GDPR, responsible for determining why and how personal data are processed, is central to accountability but breaks down in public blockchains. Application layer actors may decide how personal data is processed, while lower-level infrastructure - validators, nodes, and Layer-2 networks - should be viewed like postal workers delivering sealed letters and not liable for the content they cannot see.

European regulators should adapt enforcement to technical realities rather than forcing technology into legacy legal structures to avoid driving innovation offshore. The challenge is not to force compliance through blunt means but to ensure that privacy and innovation can coexist. A new legal interpretation of blockchain's roles under GDPR is essential to prevent decentralised networks from being burdened with compliance obligations they cannot meaningfully meet.

  1. In the context of public, permissionless blockchain networks, data controllers under GDPR are primarily front-end actors like wallets and dApps that process personal data.
  2. The blockchain's lower-layer infrastructure, consisting of consensus nodes, validators, and data availability nodes, typically handle only encrypted, pseudonymized, or anonymized data.
  3. To minimize exposure and preserve compliance, personal data should ideally be kept off-chain or transformed before reaching the blockchain's execution and consensus layers.
  4. Validators and miners maintain the network's integrity but do not make decisions about personal data processing purposes, thus releasing them from full compliance liability.
  5. Privacy-preserving techniques, such as zero-knowledge proofs, homomorphic encryption, and modular blockchain architecture, help reduce personal data directly handled on-chain.
  6. The European Data Protection Board (EDPB) guidelines support a privacy-by-design approach, emphasizing the need to assess whether personal data processing is necessary on-chain and to prefer off-chain solutions wherever possible.
  7. The European Blockchain Association advocates for a privacy-preserving design that keeps personal data off-chain wherever possible, storing identifiable data off-chain in user-facing services to reconcile blockchain's decentralization and immutability with GDPR principles.

Read also:

    Related

    Latest