# GDPR

> GDPR (European Union · national data protection authorities): Data protection · Regulation (EU) 2016/679. Region: Europe. Builds with privacy tech: The regime itself mandates, pilots or funds privacy-preserving technology.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Regulator or standard-setter
- Region: Europe
- Subject: Data protection · Regulation (EU) 2016/679
- Authority: European Union · national data protection authorities
- Stance on on-chain confidentiality: Builds with privacy tech. The regime itself mandates, pilots or funds privacy-preserving technology.
- Tags: GDPR, erasure vs immutability, privacy by design, data minimisation
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/reg-gdpr

## What it actually says

The law most often described as a problem for blockchain is also the strongest European argument for building with privacy technology. Article 25 requires data protection by design and by default, and Article 5(1)(c) requires minimisation, which is a legal instruction to publish less, not more. The friction is real in two places: Article 17 erasure against an append-only ledger, and whether a wallet address counts as personal data under Article 4(1). Worth holding onto in the AML debate, GDPR does not authorise blanket collection either. Processing for anti-money laundering still has to clear necessity and proportionality under Article 6 and the Charter. A Commission Digital Omnibus proposal from November 2025 would amend the identifiability test; treat it as pending.

## The instruments that matter

- **Article 5(1)(c) and Article 25**: data minimisation and data protection by design and by default, the strongest legal basis in Europe for building with privacy technology
- **Article 17**: the right to erasure, in direct tension with an append-only ledger
- **Article 4(1)**: whether a wallet address is personal data turns on this definition of identifiability

## Sources

- [Regulation (EU) 2016/679](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)
- [EDPB](https://www.edpb.europa.eu/)

## Related entries

- [Digital euro](https://www.sodalabs.xyz/privacy-hub/regulation/reg-digital-euro): Central bank digital currency · COM(2023) 369
- [eIDAS 2 and the EU Digital Identity Wallet](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eidas2): Digital identity · Regulation (EU) 2024/1183
- [CJEU on identifiability](https://www.sodalabs.xyz/privacy-hub/regulation/reg-cjeu-identifiability): Case law · is a wallet address personal data
- [EDPB blockchain guidelines](https://www.sodalabs.xyz/privacy-hub/regulation/reg-edpb-blockchain): Data protection guidance · Guidelines 02/2025
- [EU AMLR Article 79](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eu-amlr): Anti-money laundering · Regulation (EU) 2024/1624
- [EU Data Act, Article 36](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eu-data-act): Smart contract requirements · Regulation (EU) 2023/2854