Summary The European Data Protection Board (EDPB) has released draft guidelines addressing the storage and access of personal data on blockchains, aiming to ensure compliance with GDPR regulations. The board cautions against storing personal data directly on-chain if it risks violating fundamental data protection principles. Opinions among experts vary—some view these guidelines as essential regulatory frameworks long overdue, while others worry they may hinder decentralization and innovation in privacy. Having approved these draft rules, the EDPB moves closer to aligning decentralized technologies with existing data protection standards. The new guidelines restrict access to stored data and aim to uphold GDPR protections. Ratified this month, the rules are open for public consultation until June 9. “Blockchains possess characteristics that pose challenges in meeting GDPR requirements, ” the EDPB notes in the online draft. They emphasize the necessity of Data Protection by Design and by Default, along with appropriate organizational and technical safeguards. The document reiterates: “As a general rule, storing personal data on a blockchain should be avoided if it conflicts with data protection principles. ” These guidelines emerge amid ongoing concerns over blockchain security. GDPR establishes individual rights to safeguard personal information. Organizations are advised to integrate technical and structural measures early in data processing design, prioritizing transparency, correction, and deletion of personal data. This approach also accounts for the varying roles participants have at different stages of blockchain-based data processing. Before handling any personal data on blockchains, the EDPB recommends conducting Data Protection Impact Assessments (DPIAs), especially when processing may pose high risks to individuals’ rights and freedoms. The board stresses that personal data should not be accessible by an “indefinite number of persons by default. ” Experts on data privacy share mixed views regarding blockchain’s role and the guidelines. Bryn Bennett, Senior Business Development at Hacken—a Ukrainian Web3 security firm—told Decrypt, “the EDPB’s guidelines serve as a timely reminder that decentralization does not mean deregulation. ” “We consider privacy a core infrastructure component—not an afterthought, ” Bennett said.

“Projects that mishandle user data risk legal consequences and security failures. Privacy-by-design, off-chain data storage, and solid governance aren’t just best practices—they’re essential for survival. ” Conversely, Harry Halpin, founder and CEO of decentralized privacy company Nym Technologies, told Decrypt that “putting personal data on a blockchain is a mistake. ” “Use-cases I’ve encountered—like digital IDs or COVID passports—violate privacy and risk enabling authoritarianism, ” Halpin stated. “Personal data should employ zero-knowledge proofs off-chain and maintain network privacy through mixnets, as we do with payment data at Nym. ” He further argued: “Applying data protection laws to blockchain data is flawed because the ‘right to be forgotten’ would require decentralized blockchains to be mutable and subject to regulatory censorship. If that is desired, centralized databases would be more appropriate. ”