Protection of personal data on the blockchain

The EU experience

In April 2025 the European Data Protection Board (EDPB) released Guidelines on the processing of personal data using¹ blockchain technology to comply with GDPR. The blockchain contains personal data because it stores the data of the participants in transactions (identifiers, IP addresses), data on the amounts of cryptocurrency, the goods purchased and so on. Although the data is² encrypted, its leakage cannot be excluded. According to Defillama, in April 2025, there were 8 hacks of blockchain networks with a damage³ cost of $113 million. If data leakage occurs as a result of a hack, personal identifiers in the⁴ blockchain can be used by attackers to access real personal data (such as passport information, payment information, etc.).

The technical properties of blockchain can pose risks to GDPR compliance. Data is replicated and transmitted simultaneously between participants on different computers on the blockchain network, and any changes or deletions are visible to all participants. Furthermore, if a transaction is made, the transaction data cannot be deleted unless the data is deleted by every participant in the chain on the blockchain. This is contrary to the principle of limiting data storage to the purpose of processing and limits the data subject's right to have the data deleted and rectified.

The EDPB offers the following recommendations for the use of blockchain:

− Use a private, authorized blockchain network. There are different types of blockchain, such as private and public. In a public blockchain (such as Bitcoin and Ethereum), each participant can see and create new blocks. In a private blockchain, there is a single central node that grants permission to other participants to participate: only selected nodes can read or create blocks. Therefore, in a private blockchain, data subjects are protected from possible access to their data.

− Only a hash that identifies an individual⁵ can be stored on the blockchain, all other data can be stored privately off-chain. And if the data subject withdraws consent to data processing or wants, for example, wants to change the data, it is possible to delete the participant's hash in relation to individual transactions, making the data unidentifiable to the specific individual.

The EDPB recommends data controllers (similar to data controllers in Russia) to assess:

1) Whether the data on the blockchain will contain personal data.

2) Whether blockchain must be used or alternative technologies can be used.

3) What type of blockchain should be used.

4) Whether data will be stored on or offchain.

Russia’s experience

In Russia, there is no specific regulation regarding the protection of personal data on the blockchain. At the same time, the Federal Act №152 “On Personal Data” (as well as the GPDR in the EU) establishes the obligation of the data controller (in the EU) to destroy or anonymize data once the purposes of its processing have been achieved.

Blockchain is rapidly developing in Russia. In April 2025, Rusnano announced the use of blockchain for a system of recording and storing data on its intellectual property rights to⁶ scientific developments. However, there is a need for legal certainty regarding the use of the technology, including personal data.

From the monitoring issue No. 4 (16), April 2025. Download the full issue (PDF) · issue page at the Gaidar Institute