Future of data protection in blockchain: ICO launches consultation

On 28 August 2025, the Information Commissioner’s Office (“ICO”) launched a public consultation on its draft guidance (the “Guidance”) concerning distributed ledger technologies (“DLT”).

The consultation aims to provide practical clarity for developers and users of DLT who are grappling with how UK data protection law applies in decentralised environments. Responses are invited until 7 November 2025, with the final guidance expected to be published over winter 2025/6.

What the Guidance covers?

The Guidance explains how DLT currently operates, with blockchain highlighted as the most common form.

It stresses that identifiers such as wallet addresses, transaction IDs and smart contract details can fall within the definition of “personal data”, triggering application of the full scope of the UK’s data protection regime.

Particular attention is given in the Guidance to the complexities of assigning controller and processor responsibilities in decentralised systems, to the challenges of exercising rights such as rectification and erasure in these chains and ensuring principles of data minimisation and storage limitation.

The ICO highlights that compliance cannot be an afterthought. Businesses considering adopting DLT are urged to embed data protection by design, carry out data protection impact assessments and adopt privacy-enhancing technologies to mitigate data privacy-related risks.

The Guidance can be found in the ICO’s website HERE.

Why it matters?

The ICO’s intervention is significant. It reflects a growing recognition that blockchain and related DLT are moving into mainstream use, from finance and digital identity through to Web3 applications. The Guidance currently aims to strike a careful balance – on one hand acknowledging the value of decentralised systems, while on the other pressing for stringent governance to uphold fundamental data privacy-related rights.

For businesses, the message is clear. DLTs cannot be developed in isolation from data protection law. The regulatory expectation is that compliance must be designed in from the outset and that developers, users and adopters alike should engage with the consultation to help shape a workable framework.

What’s next?

The consultation remains open until 7 November 2025, after which the ICO will look to finalise its guidance.

Businesses working with blockchain and other distributed ledgers should review the Guidance closely, and take the opportunity to contribute feedback to the consultation.

In doing so, those operating in the blockchain and Web3 can not only anticipate compliance obligations but also influence the regulatory environment in which these technologies will develop.

This piece was written by Sanya Bhambhani and Robert Humphreys.  Do please reach out to a member of the team if you would like to discuss matters relating to DLTs or anything relating to blockchain our Web3 generally.

All the thoughts and commentary that HLaw publishes on this website, including those set out above, are subject to the terms and conditions of use of this website.  None of the above constitutes legal advice and is not to be relied upon.  Much of the above will no doubt fall out of date and conflict with future law and practice one day.  None of the above should be relied upon.  Always seek your own independent professional advice.

Humphreys Law