Encryption

This guidance discusses encryption in more detail. Read it if you have detailed questions not answered in the Guide, or if you need a deeper understanding to help you apply encryption in practice. It is aimed at DPOs and those with specific data protection responsibilities in larger organisations.

If you haven’t read the ‘in brief’ page on encryption in the Guide to Data Protection, you should read that first. It introduces this topic and sets out the key points you need to know, along with practical checklists to help you comply.

This guidance will help you to understand the importance of encryption as an appropriate technical measure to protect the personal data you hold. Whether you are a controller or a processor, encryption is a technique that you can use to protect personal data.

The guidance outlines the concept of encryption in the context of the UK GDPR’s integrity and confidentiality principle, and particularly Article 32 on security processing. It provides a summary of current forms of encryption and the considerations you should have when putting it in place, along with outlining the residual risks. Finally, it provides a number of scenarios where personal data is processed, outlining how encryption can be used to safeguard such data in respect of each scenario, and detailing some of the risks that remain.

This guidance also includes several recommendations, namely that where you are storing or transmitting personal data, you should use encryption due to its widespread availability and relatively low cost of deployment