On 8 April 2025, the European Data Protection Board (hereinafter \u201cEDPB\u201d) published Guidelines 02\/2025 on the processing of personal data through blockchain technologies, which have been submitted for public consultation until 9 June 2025.<\/p>\n
The Guidelines acknowledge that the very nature of blockchains entails inherent risks for the rights and freedoms of natural persons, considering properties such as the inability to delete or modify data, as well as its decentralized governance and storing system, and the public accessibility of information. Further, they outline key GDPR compliance parameters, assessing the core principles of blockchain and the implications of its architecture on the protection of personal data. The Guidelines also include an annex with recommendations for organisations intending to implement blockchain-based processing activities.<\/p>\n
In Greece, Law 4961\/2022 was the first national legislative act to attempt to define the complexity of blockchain technology. According to Article 31(1):<\/p>\n
\u201cBlockchain: a type of distributed ledger technology that records data in blocks, chronologically linked to form a chain of a consensual, decentralised and mathematically verifiable nature, which is mainly based on the science of cryptography<\/em>.\u201d<\/p>\n In summary, blockchain is a Distributed Ledger Technology (DLT)<\/strong> where transactions are recorded in data blocks linked in chronological order and distributed across nodes in a peer-to-peer (P2P) network, thus achieving data dissemination. In the absence of any central intermediary, the technology functions through approval and verification methods such as Proof of Work<\/strong> or Proof of Stake<\/strong>.<\/p>\n These transactions are recorded using asymmetric encryption methods<\/strong> and hash functions<\/strong>, thereby creating a tamper-resistant ledger which safeguards data integrity.<\/p>\n The EDPB highlights the mandatory conduct of a DPIA<\/strong> where high risks exist, especially if the following apply:<\/p>\n The DPIA must include at a minimum:<\/p>\n Technical and organisational measures must be implemented to limit accessibility<\/strong> and ensure compliance with Article 25(2) GDPR. For example, Proof of Existence<\/strong> methods should store only verification data on-chain, keeping original data off-chain.<\/p>\n Use state-of-the-art encryption<\/strong> and keyed hashing with strong salts<\/strong>.<\/p>\n A formal governance framework must be in place to address protocol changes<\/strong>, vulnerability disclosures<\/strong>, and breach handling<\/strong>.<\/p>\n The EDPB stresses that technical limitations stemming from blockchain architecture cannot justify GDPR non-compliance<\/strong> (see EDPB ChatGPT Taskforce Report, 2024). Organisations must either adapt their blockchain architecture or choose alternative technologies.<\/p>\n The EDPB provides specific recommendations<\/strong>. Organisations that adopt these early, will gain a strategic compliance advantage<\/strong> and reduce their exposure to sanctions<\/strong>.<\/p>\n Importantly, blockchain technology itself does not constitute data processing per se<\/strong>. However, the choice and deployment<\/strong> of such technology impacts the corresponding data processing activities and thus influences organisations\u2019 compliance with Article 24 GDPR<\/strong>.<\/p>\n Indicatively, organisations are encouraged to:<\/p>\n The draft Guidelines are subject to public consultation and may be amended following the consultation period<\/strong>.<\/p>\n For the \u00abStergios Konstantinou & Associates \u2013 SGKLegal<\/strong>\u00bb Law Office<\/p>\n Lawyer, Advanced LLM (IP & ICT Law)<\/p>\n CIPP\/E, CIPM, FIP<\/td>\n Trainee Laywer, LLM<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":" On 8 April 2025, the European Data Protection Board (hereinafter \u201cEDPB\u201d) published Guidelines 02\/2025 on the processing of personal data through blockchain technologies, which have been submitted for public consultation until 9 June 2025. The Guidelines acknowledge that the very nature of blockchains entails inherent risks for the rights and freedoms of natural persons, considering […]<\/p>\n","protected":false},"author":4,"featured_media":1608,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[267,268,269,122,117],"class_list":["post-1600","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-en","tag-blockchain-personal-data","tag-blockchain-greece","tag-dpia-en","tag-edpb","tag-espd"],"_links":{"self":[{"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/posts\/1600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/comments?post=1600"}],"version-history":[{"count":1,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/posts\/1600\/revisions"}],"predecessor-version":[{"id":1601,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/posts\/1600\/revisions\/1601"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/media\/1608"}],"wp:attachment":[{"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/media?parent=1600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/categories?post=1600"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/tags?post=1600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Key EDPB Observations in the Draft Guidelines<\/h1>\n
2.1\u00a0\u00a0 Design and Architecture<\/h2>\n
\n
2.2\u00a0\u00a0 Principles of Data Processing<\/h2>\n
\n
2.3\u00a0\u00a0 Data Subject Rights<\/h2>\n
\n
2.4\u00a0\u00a0 Data Protection Impact Assessment (DPIA)<\/h2>\n
\n
\n
2.5\u00a0\u00a0 Technical and Organisational Measures<\/h2>\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 What Are the Next Steps for Organisations Exploring or Already Using Blockchain?<\/h1>\n
\n
\n\n
\n Stergios G. Konstantinou<\/strong><\/p>\n Eva Pitsi<\/strong><\/p>\n