EU Data Protection & PETs

GDPR (personal-data processing) and DORA (ICT resilience and incident reporting) apply to crypto entities alongside MiCA. The live tension for builders is personal data on immutable ledgers: erasure rights and the anonymisation-vs-pseudonymisation line are being actively clarified by the EDPB. Privacy-enhancing technologies (PETs) such as zero-knowledge proofs and selective disclosure are increasingly discussed as ways to reconcile data protection with on-chain transparency.

Key regulations

  • GDPR (Reg. (EU) 2016/679)
  • DORA (Reg. (EU) 2022/2554)
  • MiCA (Reg. (EU) 2023/1114)

Entities

  • CASPs
  • custodians
  • exchanges
  • wallet providers

Activities

  • custody
  • KYC/AML
  • data processing
  • cross-border transfers

Developer orientation. Not legal advice.

What to Watch

  • Anonymisation vs pseudonymisation classification (EDPB Guidelines 01/2025), which determines whether GDPR applies.
  • Right-to-erasure vs ledger immutability (EDPB Guidelines 02/2025).
  • Divergent Member-State views on whether PETs satisfy AML record-keeping.

See also