Blockchain and the GDPR: the EDPB’s final guidelines for the FinTech and crypto sectors

On 7 July 2026, the European Data Protection Board (EDPB) adopted the final version 2.0 of Guidelines 02/2025 on processing of personal data through blockchain technologies. The final text follows a public consultation of the draft published in April 2025 and applies to any business whose processing of personal data relies on blockchain, in particular crypto-asset service providers (CASPs), payment institutions and issuers of tokenised assets.

Personal data on the blockchain – key changes to the EDPB guidelines

The overall framework remains the same: storing personal data on-chain should be avoided, data protection must be built in by design, and a Data Protection Impact Assessment (DPIA) is expected before deployment.

However, the final version introduces several important adjustments:

• Softer position on nodes as controllers. The draft suggested that validating nodes in public blockchains could generally be treated as data controllers. The final version states that nodes performing purely technical validation, without deciding on the purposes or essential means of processing, may fall outside the controller role. Only nodes exercising a decisive influence may qualify as controllers or joint controllers, and the EDPB still encourages establishing a consortium or another legal entity to act as controller.
• Clear preference for permissioned blockchains. Organisations should favour permissioned architectures and may depart from this preference only for well-justified, documented reasons. Where such reasons exist, they should also reconsider whether blockchain is the right technology at all.
• Broader scope of on-chain personal data. Wallet addresses, public keys, transaction identifiers, event logs, receipts and smart contract storage may all constitute personal data where a natural person is identifiable.
• Sector-specific retention periods. The EDPB expressly refers to the retention obligations under the MiCA Regulation and the new EU Anti-Money Laundering Regulation (applicable from 10 July 2027), which require identification and transactional data to be kept for at least five years after the business relationship ends.
• A narrow allowance for on-chain storage. In particular cases, directly identifying data may be stored on a public blockchain, but only where the purpose justifies it and a DPIA confirms that the risks have been addressed.

Who are the EDPB’s blockchain guidelines aimed at?

The Guidelines are relevant for CASPs, payment and e-money institutions using distributed ledger technology, issuers of tokenised financial instruments, and any company building products on public or private blockchains that touch personal data, including wallet providers and dApp operators.

Implementation of the EDPB guidelines – key actions for businesses

• Review the architecture of existing and planned blockchain projects against the final Guidelines, in particular the choice between permissioned and permissionless models.
• Verify and document the allocation of controller and processor roles, including the governance framework and contractual arrangements between participants.
• Update or carry out a DPIA covering the blockchain-specific risk areas listed in the Guidelines.
• Align data retention rules with GDPR, MiCA and AML requirements, and ensure erasure or anonymisation is technically feasible.

What are the consequences of a blockchain not complying with the GDPR?

The EDPB confirms that technical impossibility cannot justify non-compliance with the GDPR. Architectures that make erasure or rectification unworkable expose controllers to supervisory measures and administrative fines, and may require costly redesign of the entire solution.

Blockchain and the GDPR – prepare your business for the new EDPB guidelines

If your company uses blockchain technology to process personal data, it is worth verifying that your solutions comply with the final EDPB guidelines. Our lawyers from the FinTech and data protection teams will help you assess your project’s architecture, correctly assign roles under the GDPR, and prepare or update your DPIA.

Contact us to discuss how the new guidelines affect your blockchain project and what compliance measures you should take. You can also find further information in our article on blockchain and the GDPR, as well as on our pages dedicated to the GDPR and the implementation of MiCA in Poland.