Regulation and data
Encryption
Encryption is the technique that turns data into text nobody can read without the key. The GDPR names it among the security measures of its art. 32 and gives it a practical effect: if encrypted data are lost and the key is safe, it may not be necessary to tell each person affected.
Also known asdata encryption · encrypting personal data · cifrado
What counts under the GDPR
The GDPR does not require everything to be encrypted: it asks for security appropriate to the risk and gives encryption as an example, alongside pseudonymisation (art. 32.1.a and recital 83). In a residence the risk is set by the data: the gym timetable does not weigh the same as an allergy, which is health data, or the account in a report to the reporting channel. People speak of three layers:
- In transit: what travels between the phone, the server and the dashboard, so that nobody reads it on the way.
- At rest: what stays stored in the database, on a laptop or in a backup.
- Per field: only the most sensitive columns, with a separate key, so that not even whoever administers the database can read their content without it.
Where it shows most is when something goes wrong. Art. 34.3.a exempts the controller from telling those affected about a data breach if the data were unintelligible to whoever accessed them, "such as encryption". The AEPD's guide on breaches spells it out: the risk is mitigated if the algorithm is secure and the key has not been compromised.
Worth knowing
Encryption is useless if the key sits next to the data. If the key travels with the data or the whole team knows it, it protects nothing. The same guide warns that storing passwords as a hash made with outdated algorithms, such as MD5 or SHA-1, does not mitigate the risk. And encryption only exempts the controller from telling those affected (art. 34): art. 33, on notifying the supervisory authority, does not mention it, and there it counts towards judging whether the breach poses a risk.
Sources
Related terms
- Personal data breachA personal data breach is any breach of security that results in the accidental or unlawful destruction, loss or alteration of personal data, or to their unauthorised disclosure or access (art. 4.12 of the GDPR). Losing a staff phone with residents' data, or sending a list by mistake, are breaches.
- PseudonymisationPseudonymisation means processing personal data so that they can no longer be attributed to a person without additional information that is kept separately and protected (art. 4.5 of the GDPR). Pseudonymised data are still personal data; anonymous data are not.