Encrypted Data

Encryption is the baseline technical control for personal data at rest, in use and in motion. At rest, data on disk is encrypted with a key stored in a Key Management Service (KMS), unlocked when authorised processes read it. In motion, TLS 1.2+ protects data crossing networks. In use, confidential computing and application-layer field encryption protect data in memory and in query. GDPR Article 32, DPDP Section 8(5) and PDPA all cite encryption explicitly as a safeguard, and under GDPR Article 34(3)(a) an organisation can avoid individual breach notification where lost data is strongly encrypted and the key was not compromised.

Encryption is not anonymisation — the data remains personal data under all three regimes, and all the DSR, retention and transfer obligations still apply. The practical gain is confidentiality: a lost backup tape, a mis-configured S3 bucket or a stolen laptop with strong encryption is a security event, not a breach-notifiable loss. Key management is the real craft: the strongest cipher is undone by a weak key store, which is why KMS integrations, HSMs and documented key-rotation schedules are the audit-grade controls regulators inspect.