EDPB blockchain guidelines

Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.

What EDPB blockchain guidelines actually says

The reference text on how European data protection law lands on a ledger, final since 7 July 2026. Its positions are demanding: a public key is personal data whenever it can be associated with an identifiable person, encrypted or hashed on-chain data is not automatically outside GDPR, and unsalted hashes are treated as insufficient on a public chain. On erasure the Board offers architecture rather than a doctrinal exemption. Keep personal data off-chain, delete the off-chain identifiers, or render the on-chain data effectively anonymous, which it concedes is technically demanding. It prefers permissioned designs and treats permissionless ones as needing justification. Zero-knowledge constructions and commitments are acknowledged as mitigations, not exemptions. Guidelines are not binding law, but supervisors follow them.

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.