Can on-chain personal data be forgotten? The European Data Protection Board has released guidelines for blockchain personal data processing, collaborating with the AI Office to promote new regulations.

In the face of the rapid development of Blockchain and artificial intelligence (AI) technologies, the European Data Protection Board (EDPB) took action at its plenary meeting in April 2025, releasing new guidelines for the processing of personal data in relation to blockchain technology, while also announcing a collaboration with the AI office to develop guidelines regarding the interaction between the AI legislation and the EU data protection law.

GDPR Compliance: New Guidelines for Blockchain Data Processing Officially Launched

Blockchain, as a decentralized digital ledger technology, can confirm transactions and prove the ownership of digital assets such as cryptocurrency ( at a certain point in time. It is also commonly used to securely manage and transmit data, ensuring data integrity and traceability.

As the application of Blockchain becomes increasingly widespread, the EDPB believes it is necessary to assist organizations using this technology to ensure compliance with the General Data Protection Regulation (GDPR). The new guidelines delve into how Blockchain operates, various architectural forms, and the potential impacts these designs may have on personal data processing.

Data protection should be carefully considered during the design phase.

The EDPB emphasizes that appropriate technical and organizational measures must be incorporated at the initial stage of data processing design to prevent future data protection issues. At the same time, organizations should clarify the roles and responsibilities of all parties involved in the data processing process when designing Blockchain processing workflows.

If the behavior of the Blockchain in processing personal data may pose a high risk to individual rights and freedoms, organizations must conduct a "Data Protection Impact Assessment" )DPIA( in advance to proactively identify and mitigate potential risks.

Reducing the risk of personal data leakage is of utmost importance.

According to the guidelines, organizations should ensure that personal data on the Blockchain is protected at the highest level, avoiding default access to unlimited groups of people.

The EDPB also provides several examples of data minimization techniques on how to properly handle and store personal data. In principle, if the storage of personal information on the blockchain may conflict with the data protection principles, it should be avoided as much as possible.

In addition, the guidelines particularly emphasize the need to ensure the transparency of personal data, the right to data correction, and the right to deletion. These fundamental rights are especially prone to being overlooked in a Blockchain architecture, thus requiring extra attention.

If it's not well designed, we might have to delete the entire blockchain?

The guidelines state that personal data must be deleted after the purpose of processing has been achieved and after any statutory retention period has expired, in order to comply with the principle of data minimization. After the statutory retention period has expired, personal data must be deleted to comply with the principle of data minimization.

In a blockchain, deleting individual data can be challenging and requires specially designed architecture. If the deletion function is not considered during the design phase, it may be necessary to adopt a special engineering architecture to implement it, which might also require deleting the entire blockchain.

If compliance design for on-chain and off-chain data has been considered, and data protection has been designed in mind, there may be ways to prevent future identification of data subjects by deleting off-chain data, depending on the choice of method and the specific facts. Regardless of the storage limit method you choose, you must comply with the validity. If this requires the deletion of a part of the blockchain, including the deletion of any copies held by nodes or other parties, the controller shall ensure that adequate technical and organizational measures are in place to do so.

Public consultation open until early June

This blockchain data processing guideline is currently open for public consultation, with a deadline of June 9, 2025. The EDPB invites all stakeholders to provide feedback to make the final version more aligned with practical needs.

EDPB collaborates with the AI office to establish new AI regulations

In addition to releasing new guidelines for blockchain technology, the EDPB also announced at this plenary meeting that it will work closely with the newly established "AI Office" to jointly draft guidance on the integration of AI cases with existing data protection regulations. In the future, as AI applications continue to expand, this cross-disciplinary cooperation document will become an important basis for businesses and developers.

Can on-chain personal data be forgotten? The European Data Protection Board has released guidelines for blockchain personal data processing, collaborating with the AI office to promote new regulations, first appearing in Chain News ABMedia.