GDPR (General Data Protection Regulation)

The General Data Protection Regulation is the European Union's comprehensive data protection law that came into force in May 2018, establishing strict requirements for collecting, processing, storing, and deleting personal data of EU residents, with extraterritorial application to any entity processing EU personal data regardless of location.

GDPR grants individuals rights including access to their data, rectification of inaccuracies, erasure (right to be forgotten), data portability, and objection to processing. Organizations must implement privacy by design, maintain data processing records, conduct impact assessments for high-risk processing, appoint data protection officers, and report breaches within 72 hours. Violations can result in fines up to 20 million euros or 4% of global annual revenue.

GDPR creates fundamental tensions with public blockchain architecture. Blockchain's immutability conflicts with the right to erasure since on-chain data cannot be deleted. Wallet addresses and transaction histories may constitute personal data when linked to identifiable individuals, creating compliance obligations for blockchain infrastructure operators. Solutions include storing only hashed or encrypted data on-chain with off-chain personal data storage, using permissioned blockchains with selective data access, or implementing zero-knowledge proofs enabling verification without exposing underlying personal information. The EU's eIDAS 2.0 and EUDI Wallet frameworks attempt to reconcile blockchain benefits with GDPR privacy requirements through cryptographic selective disclosure.