Encryption

What it means

Encryption turns data into a form that cannot be read without a key. Transport encryption protects data travelling between two points; storage encryption protects data at rest on a disk.

On the web it is provided by TLS and an SSL/TLS certificate, inside a company network by a VPN, and for messages and files by end-to-end encryption.

Encryption is neither pseudonymisation nor hashing. Encrypted data comes back whole in its original form with the key, pseudonymised data stays readable but without direct identifiers, and a hash cannot be turned back into the original at all, which is why passwords are stored that way.

How it works in practice

The practical minimum for a company: HTTPS on the website, encrypted disks on laptops and phones, encrypted backups, and a protected way to send sensitive attachments. These are settings made once that then work continuously.

GDPR names encryption as an example of an appropriate technical measure. In an incident it can matter directly: a lost encrypted disk is assessed differently from an unencrypted one.

We send payslips and payroll records to our clients’ employees as password-protected files or through a portal, not as an ordinary e-mail attachment. The password travels by a different channel from the file, so a mistyped recipient address does not yet mean a personal data leak.

What to watch out for

Encryption is only as strong as key management. A password stuck to the laptop or stored in the same folder as the backup removes the protection entirely. And it does nothing against an authorised user who copies the data out.

The reverse problem: a lost key means lost data. If only one administrator knows the recovery key of an encrypted disk or backup, their departure or a device failure can cost the company years of accounting records that the law requires it to archive and produce on request.