Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

EDPB issues final guidelines on processing personal data with blockchain technologies

The European Data Protection Board (EDPB) published its final Guidelines on processing of personal data through blockchain technologies on 27 August 2026, clarifying that participants determining the purposes and means of processing personal data on a blockchain will generally be considered controllers. These guidelines provide a framework for organisations considering the use of blockchain technology, outlining key GDPR compliance considerations for planned processing activities. They emphasise that storing personal data on a blockchain should be avoided if it conflicts with data protection principles.

The EDPB guidelines, adopted under Article 70 (1)(e) of Regulation 2016/679/EU, provide practical guidance for controllers planning to use blockchain technology. They detail that roles and responsibilities of different actors in a blockchain related processing need assessment during design, considering elements like block data structure, stakeholder roles, consensus algorithms, and governance mechanisms. The document stresses the importance of Data Protection by Design and by Default, along with adequate organisational and technical measures, including techniques for data minimisation and handling personal data.

The guidelines discuss the interplay between blockchain's technical aspects and data protection principles under Article 5 GDPR, particularly regarding transparency, rectification, and erasure. They also highlight the necessity of conducting a Data Protection Impact Assessment (DPIA) prior to implementing blockchain based processing, providing key aspects for a structured DPIA. Annex A offers concise recommendations for organisations setting up such processing.

The distributed and often immutable nature of blockchain technology presents unique challenges for applying traditional data protection frameworks, necessitating specific guidance from regulators.

Article 70 (1)(e) of Regulation 2016/679/EU

Who this binds
Organisations and individuals involved in designing, developing, or deploying blockchain solutions that process personal data within the EU are bound by these guidelines.
What changed
The EDPB has clarified that participants determining the purposes and means of processing personal data on a blockchain will generally be considered controllers, as stated in their final guidelines published 27 August 2026.
What to check
Organisations should review Annex A of the guidelines for a set of concise recommendations on setting up blockchain based processing.
What this does not mean
This guidance does not mean that all blockchain processing is inherently non compliant with GDPR, but rather provides a framework for achieving compliance.

Send this to your team

The European Data Protection Board published final guidelines on 27 August 2026, stating that participants determining the purposes and means of processing personal data on a blockchain will generally be considered controllers, affecting all organisations using blockchain technology that processes personal data.

Today's question

An organisation operating in the EU uses a public blockchain to record transactions that include hashed personal data. Under the EDPB's guidelines, which of the following is the most appropriate initial step for ensuring GDPR compliance?

  1. Assume all participants are joint controllers and implement a joint controller agreement.
  2. Conduct a thorough Data Protection Impact Assessment (DPIA) to identify roles and risks.
  3. Encrypt all personal data before hashing and storing it directly on the blockchain.
  4. Obtain explicit consent from all data subjects for the immutable storage of their data.

Answer this question on the site

Worth knowing

  1. IAPP highlights Cyber Resilience Act's impact on EU incident notifications

    Organisations operating in the EU, particularly those in healthcare and medtech, must update their incident response plans to account for the additional reporting obligations and complexities introduced by the Cyber Resilience Act.

  2. Brazilian court rules real estate data processing for prospecting is illegal without consent

    Brazilian real estate companies and any organisation engaging in direct marketing must ensure they have a valid legal basis, such as explicit consent, for processing personal data for prospecting activities under the LGPD.

  3. Turns out Brits would quite like their private messages to stay private

    This article from The Register underscores persistent public concern in the UK regarding the privacy of personal communications, which can influence regulatory debates around end to end encryption and government access.

  4. Serviço, risco e regulação no Marco Civil da Internet

    This analysis from JOTA provides insight into how the Brazilian ANPD could interpret and apply the Marco Civil da Internet, potentially shaping regulatory requirements for digital service providers based on their inherent risks.

  5. Sony Music and Warner Chappell are suing Anthropic

    This lawsuit by Sony Music and Warner Chappell against Anthropic signals an escalating legal battle over copyright infringement and the unauthorised use of creative works in AI model training, impacting the AI governance landscape.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.