This guidance will help you to understand the importance of encryption as an appropriate technical measure to protect the personal data you hold. Whether you are a controller or a processor, encryption is a technique that you can use to protect personal data.
The guidance outlines the concept of encryption in the context of the GDPR’s integrity and confidentiality principle, and particularly Article 32 on security processing. It provides a summary of current forms of encryption and the considerations you should have when putting it in place, along with outlining the residual risks. Finally, it provides a number of scenarios where personal data is processed, outlining how encryption can be used to safeguard such data in respect of each scenario, and detailing some of the risks that remain.
This guidance also includes several recommendations, namely that where you are storing or transmitting personal data, you should use encryption due to its widespread availability and relatively low cost of deployment.