If the stolen data was encrypted, must we still notify?

Possibly the authority, but often not the people affected. Article 34(3)(a) of the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). says that individuals need not be told about a breach if the controller had applied measures, such as encryption, that render the data unintelligible to anyone not authorised to access it. The notification to the supervisory authority under Article 33 is a separate question: it is needed unless the breach is unlikely to result in a risk to people, and that depends on how strong the encryption was, whether the key was also exposed and whether the data is still available to you. If the key was on the same stolen laptop, or the encryption was weak, the data should be treated as exposed. Record which data was encrypted, how, and where the keys were. Network evidence of what left, and when, helps your data protection officer make the call.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics