Set by the law · GDPR Art. 32(1)(a)
Encryption
In plain English
A way to make data unintelligible to anyone not authorised to access them. The GDPR names it as a security measure, and if breached data were encrypted the controller need not inform the people affected.
The official text
the pseudonymisation and encryption of personal data
The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met: (a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption
transport encryption and data-at-rest encryption even taken together, do not constitute a supplementary measure that ensures an essentially equivalent level of protection if the data importer is in possession of the cryptographic keys
883 decisions on Fino cite Article 32 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.