Are crypto wallet addresses personal data? What it means for companies that process them

Yes, in most cases a crypto wallet address is personal dataunder the GDPR — even a self-custody address that looks anonymous. The intuition that “an address on a hardware device is anonymous; only an exchange address with KYC is personal” is wrong in law. This article explains why, and what follows for companies that process such addresses: exchanges, crypto payment processors, Web3 platforms and businesses that accept crypto payments.

Pseudonymous is not anonymous

A wallet address is a pseudonym, not anonymous data. The distinction is not academic: it decides whether the GDPR applies.

Recital 26 is clear: anonymous data falls outside the Regulation, while pseudonymised data remains personal data, precisely because a route to re-identification exists. An address does not erase the link to the person; it hides it behind a string of characters.

On a blockchain, an address’s entire history is public and permanent. That makes re-identification possible, not impossible — the opposite of what anonymity would require. A distributed ledger that keeps every transaction of an address forever is, by its nature, fertile ground for indirect identification.

This is also the position of the European Data Protection Board. In Guidelines 02/2025 on processing personal data through blockchain technologies — put to public consultation in April 2025, with the final version 2.0 adopted on 7 July 2026 — the EDPB explains that metadata stored on a blockchain, although pseudonymised, can contain identifiers such as public keys and addresses that lead to indirect identification when combined with other identifiers.

The “reasonable means” test — same address, different status

The key question is not “does the exchange do KYC?” but “can someone, with reasonable means, link the address to an identifiable person?”

Recital 26 requires account to be taken of all means reasonably likely to be used — by the controller or by another person — to identify someone, considering cost, time and available technology. In Breyer (C-582/14) the Court of Justice adopted a relative approach: information is personal data for a controller that has lawful means reasonably likely to be used to re-identify the person, even where the additional information is held by a third party. The judgment of 4 September 2025 in C-413/23 P, EDPS v SRB, confirmed that the assessment is made from the perspective of the party concerned and the means reasonably available to it.

In practice, the same address can be personal data for an exchange that holds KYC data, and practically unidentifiable for a casual observer looking at a public explorer. A company that has — or can reasonably obtain — the means to re-identify treats the address as personal data. It cannot hide behind “it is just a public string”.

Why self-custody addresses can be personal data too

Once a self-custody address interacts with a KYC point — a deposit to or withdrawal from an exchange, a card on-ramp — the link to a real identity becomes possible. From then on, the supposed anonymity is gone for anyone with access to both ends of the link.

Clustering techniques (chain analysis) associate several addresses with each other and with a single entity. We mention them strictly as an argument about identifiability, not as a method: their existence shows that re-identification is practicable, not hypothetical.

A nuance in the other direction: a public string does not become personal data merely because it can be seen on an explorer. It becomes personal data together with identifiability — when, somewhere, reasonable means exist to link it to a person.

The obligations of a company that processes wallet addresses

• A lawful basis for each purpose (Article 6)

  Contract, legal obligation, legitimate interest with a written assessment, or consent — documented per purpose. For crypto-asset service providers, anti-money laundering law and Regulation (EU) 2023/1113 on information accompanying transfers, which since 30 December 2024 requires originator and beneficiary information, including distributed ledger addresses, to travel with crypto-asset transfers, provide a legal obligation for part of the processing — and only for that part.

• Information to data subjects (Articles 13 and 14)

  Before processing, and before data is written to the chain, in clear and plain language.

• Data subject rights

  Access, rectification, erasure and portability, with a mechanism that works on a blockchain infrastructure too.

• Data protection by design and by default (Article 25)

  Technical and organisational measures from the earliest stages of design. Compliance is designed in, not added at the end.

• A data protection impact assessment (Article 35)

  Before processing through a blockchain, especially where the infrastructure is permissionless, outside the controller’s control, or involves international transfers.

For when and how to carry out the assessment, see DPIA in Romania — when it is mandatory.

The right to erasure versus immutability

This is the hardest practical problem: how do you erase personal data from a ledger that, by design, cannot be changed?

The EDPB is firm: technical impossibility cannot be invoked to justify non-compliance with the GDPR. Its general rule is that storing personal data on a blockchain should be avoided where it conflicts with data protection principles.

The design answer is not to store personal data on-chain. Keep it off-chain and record on the chain only references or hashes that can be severed from the identity. Erasure then consists in destroying the off-chain link and keys; what remains on the chain becomes meaningless without the element kept outside it. The on-chain/off-chain architecture has to be decided before launch: a blockchain solution launched without it is often impossible to bring into compliance afterwards.

Special categories by inference (Article 9)

Public transactions can reveal sensitive information through analysis: donations to political or religious organisations, payments to health services and more. Following the Court’s case law (C-184/20, OT), data from which a special category can be inferred falls under Article 9, with much stricter requirements. A company processing addresses has to assess this risk rather than dismiss it because “we only see addresses and amounts”.

What a company working with wallet addresses should do

1. 1

   Map where and how wallet addresses are processed, in the record of processing activities.

2. 2

   Set the lawful basis and purpose for each processing activity.

3. 3

   Inform data subjects before processing and before anything is written to the chain.

4. 4

   Keep personal data off-chain; on-chain, keep only what is strictly necessary.

5. 5

   Carry out a DPIA before launch if a blockchain is involved.

6. 6

   Prepare mechanisms for the exercise of rights, including erasure by severing the off-chain link.

7. 7

   Assess the risk of special category data by inference.

The sector view is on financial services.

Conclusion

In most business contexts a crypto wallet address is personal data, and the company that processes it has real GDPR obligations: a lawful basis, information, data subject rights, protection by design and, often, a DPIA. The argument that it is “just a public string” does not survive the reasonable means test. The practical key is to design the processing architecture from the start — especially the tension between erasure and an immutable ledger.

Frequently asked questions