GDPR Q18

Do I need to encrypt all personal data?

Q18. Do I need to encrypt all personal data?

Category: Security

The UK GDPR does not demand encryption for every situation, but it requires appropriate security measures. Encryption is often a sensible control for protecting personal data.

In simple terms

Assess risks to decide when encryption is necessary.
Combine encryption with other technical and organisational measures.
Document decisions to show compliance with Article 32.

Risk-based approach

Article 32 asks you to consider the state of the art, implementation costs, and the nature of processing. High-risk data—such as special category data or large volumes—generally warrants strong encryption.

Use encryption for mobile devices, backups, and data in transit.
Consider pseudonymisation to reduce risk if data is breached.
Keep encryption keys secure and separate from encrypted data.

Beyond encryption

Security also covers access controls, regular testing, policies, and staff training. Encryption is not a silver bullet but part of a layered defence.

Implement multi-factor authentication for sensitive systems.
Patch software promptly and monitor for vulnerabilities.
Provide staff with guidance on handling encrypted files securely.

Practical steps to take

Identify the sensitivity and volume of data you hold.
Evaluate where data is stored and transmitted.
Choose encryption solutions that meet recognised standards.
Document key management procedures and responsibilities.
Test and review controls regularly.

Real-life examples

Encrypted laptops

A charity enables full-disk encryption on all laptops so lost devices do not expose beneficiary data.

Secure emails

A law firm uses encrypted email gateways when sending case files to clients.

Helpful reminders

Encryption reduces risk but does not replace good access controls.
Keep an inventory of encrypted devices and systems.
Train staff to report lost or stolen devices immediately.

Key takeaway

Use encryption as part of a layered security strategy tailored to your risks.

Article references

Article 32 – Security of processing