LGPD and blockchain: tensions and possibilities

The LGPD (Lei Geral de Proteção de Dados, Brazil’s General Data Protection Law) was written for databases that someone controls and can edit. Whoever processes the data is accountable for it, corrects what is wrong and deletes what is no longer needed.

Blockchain was built with the opposite goal. It is a record copied across many computers, in which no single participant can change what has already been recorded. That is what makes it useful for proving that something happened, and that is what creates friction with the law.

This article explains where the tensions lie, what regulators in Brazil and Europe say and which technical designs reduce the problem. It is not a legal opinion: where there is interpretation, it is the editorial team’s and is marked as such. A concrete project needs analysis by a data protection professional.

What the LGPD considers personal data

The LGPD defines personal data as information related to an identified or identifiable natural person. Anonymized data is data whose subject cannot be identified, considering the reasonable technical means available at the time (LGPD, Art. 5, I and III).

The important detail is in Art. 12: anonymized data falls outside the law, except when anonymization can be reversed with reasonable effort. In other words, hiding the name is not enough. If it is possible to trace back to the person by reasonable means, the data remains personal.

On a public blockchain, this reaches beyond names and documents. A wallet address does not carry your name, but it can be linked to you through an exchange account or through transaction patterns, as we explain in privacy on public blockchains and in on-chain analysis. In the editorial team’s assessment, treating addresses and transaction metadata as automatically anonymous data is therefore a fragile assumption.

The European view points in the same direction. In Guidelines 02/2025, adopted in final form on July 7, 2026, the European Data Protection Board (EDPB) states that encrypted personal data is still personal data and that the hash of personal data is also considered personal data (EDPB, Guidelines 02/2025, paragraphs 51 and 52). A hash is a fixed-length “fingerprint” calculated from a piece of data; it does not reveal the data directly, but it can be compared with it.

First tension: who is responsible

The LGPD organizes responsibility around two roles. The controller is whoever makes decisions about the processing; the processor handles the data on the controller’s behalf (Art. 5, VI and VII).

The guide on processing agents by the ANPD (Autoridade Nacional de Proteção de Dados, Brazil’s data protection authority) explains that the controller is whoever decides on the purposes and essential elements of the processing. The guide also notes that, although the LGPD does not use the term, the existence of joint controllership can be inferred, when more than one agent decides jointly (ANPD, guide on processing agents, version 2.0).

On a public, permissionless blockchain, fitting these roles is difficult. Thousands of nodes (the computers that keep copies of the network) store the data, but none of them receives instructions from a controller. The European Parliament’s 2019 study sums up the problem: European law assumes that all personal data has at least one controller, and blockchains make it difficult to assign that responsibility (European Parliament, 2019).

The responses of European regulators point to some paths:

• The French data protection authority (CNIL) considers that the participant who decides to record data on the network can be considered a controller, because it is the one defining purpose and means (CNIL, 2018).
• The EDPB accepts that, in certain public networks, nodes may be controllers or joint controllers, for example when they decide as a group to change the protocol rules. In such cases, it recommends that the nodes form a consortium or other legal entity to take on that role (paragraphs 43 and 44).

This guidance applies to the European regulation (GDPR), not to the LGPD. In the editorial team’s assessment, however, the concepts are close enough to serve as a reference in Brazil, where, as of October 8, 2026, the editorial team had not found any specific ANPD guidance on blockchain.

Second tension: correction and deletion

Article 18 of the LGPD gives data subjects, among other rights, the right to request correction of incomplete, inaccurate or outdated data and the anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law. It also provides for deletion of data processed on the basis of consent (Art. 18, III, IV and VI). Article 16 requires data to be deleted after processing ends, with exceptions such as compliance with a legal obligation.

A blockchain has no delete button. To change an old block, all nodes would have to agree and update their copies, which contradicts the network’s very reason for existing. The EDPB describes exactly this and adds a decisive point: technical impossibility cannot be invoked to justify non-compliance with the law (paragraph 50).

The practical consequence, according to the EDPB, is that the right to deletion has to be addressed in the system’s design, before any data is recorded. If blockchain’s strong integrity is not necessary for the purpose, the board recommends using another tool (paragraphs 102 and 103).

Third tension: the principles of Art. 6

The LGPD lists principles that all processing must follow (Art. 6). Some carry particular weight here:

• Necessity: process the minimum data needed for the purpose. Copying data across hundreds of nodes around the world is rarely the minimum necessary.
• Data quality: ensure that data is accurate and up to date. In an immutable record, the outdated version stays there.
• Purpose: use data only for the purposes disclosed. On a public network, anyone can read and reuse what was recorded.
• Security and accountability: protect the data and be able to demonstrate that the measures work.

There is also international transfer. On public networks, nodes are located in many countries. The LGPD only allows personal data to be transferred abroad in the cases listed in Art. 33, and the ANPD regulated the mechanisms, such as standard contractual clauses and adequacy decisions, in CD/ANPD Resolution No. 19 of 2024 (ANPD, Resolution No. 19/2024). In the editorial team’s assessment, applying contracts to anonymous, unknown nodes is very difficult in practice, which reinforces the recommendation not to record personal data on open networks.

Technical solutions and their limits

European regulators describe some techniques to reduce the tension. All of them have limits.

Technique	How it works	Limit identified
Data off-chain	The data stays in a regular system; the blockchain stores only a pointer or a proof	The external system also processes personal data and has its own risks
Keyed or “salted” hash	The hash of the data combined with a secret is recorded; deleting the secret and the data breaks the link	An unkeyed or unsalted hash generally does not provide enough protection on a public network
Cryptographic commitment	A mathematical proof that, without the original data, does not allow it to be recovered or recognized	Depends on a well-chosen scheme and on the actual deletion of the data and the secret
Encryption	Only the key holder can read the data; deleting the key makes it unreadable	Encrypted data is still personal, and today’s encryption may be broken in the future

Table source: editorial team’s summary based on the EDPB (paragraphs 51 to 54) and the CNIL.

The EDPB’s central recommendation is to keep personal data off the blockchain and record on it only something that works as proof of existence. The CNIL, in 2018, already pointed to the same techniques and warned that, for rights such as deletion and correction, they do not produce effects strictly identical to true erasure. That is why each solution needs to be assessed case by case.

The EDPB also mentions privacy-enhancing technologies, such as zero-knowledge proofs, which make it possible to prove something without revealing the data. But it notes that they need to be tested and combined with other measures (paragraph 56).

Where blockchain can help

The tension is not the whole story. The European Parliament study concluded that compatibility cannot be decided generically, only case by case, and that, in specific situations, the technology may even help achieve data protection goals.

The CNIL gives an example: immutability can be used to track consent, proving when and how someone authorized a use. Models of decentralized identity and verifiable credentials also explore the idea of giving data subjects more control, keeping the data with them and using the network only for verification.

Another point is the type of network. The CNIL notes that private blockchains, with known participants, work essentially as distributed databases and do not raise such specific issues. The difference between the models is covered in public versus private blockchain.

Questions before putting personal data on-chain

The questions below follow the logic of the EDPB’s recommendations. They do not replace legal analysis.

• Is blockchain necessary? What does it do that a regular database, with an audit log, would not?
• What personal data goes on the network, including addresses and transaction metadata?
• Who is the controller, and who is accountable if something goes wrong?
• How will a request for correction or deletion be handled if the data has already been recorded?
• Is the network public or permissioned? Where are the nodes?
• Was a data protection impact assessment carried out? The LGPD provides for this document (Art. 5, XVII, and Art. 38), and the EDPB recommends an impact assessment before using blockchain when there is high risk.

Key takeaways

• The LGPD assumes data can be corrected and deleted; blockchain was made not to change. That is the heart of the tension, and technical impossibility is no excuse, according to the EDPB.
• Hashing and encryption do not make data anonymous automatically. Under the LGPD, if identification can be reversed with reasonable effort, the data remains personal.
• The safest path, according to European regulators, is to keep personal data off the network and record on it only proofs that become meaningless when the original data is deleted. In Brazil, the editorial team has not found any specific ANPD guidance on blockchain yet.