# If the stolen data was encrypted, must we still notify?

Possibly the authority, but often not the people affected. Article 34(3)(a) of the GDPR says that individuals need not be told about a breach if the controller had applied measures, such as encryption, that render the data unintelligible to anyone not authorised to access it. The notification to the supervisory authority under Article 33 is a separate question: it is needed unless the breach is unlikely to result in a risk to people, and that depends on how strong the encryption was, whether the key was also exposed and whether the data is still available to you. If the key was on the same stolen laptop, or the encryption was weak, the data should be treated as exposed. Record which data was encrypted, how, and where the keys were. Network evidence of what left, and when, helps your data protection officer make the call.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/if-stolen-data-was-encrypted-must-we-still-notify

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [We cannot complete the GDPR notification within 72 hours. Can we notify in phases or late?](https://netsenx.com/en/faq/we-cannot-meet-72-hours-can-we-notify-in-phases)
- [When does the GDPR 72-hour notification clock start?](https://netsenx.com/en/faq/when-does-the-gdpr-72-hour-clock-start)
- [One incident, several reports: how do NIS2, the GDPR and DORA fit together?](https://netsenx.com/en/faq/one-incident-several-reports-nis2-gdpr-dora)
- [What is a major ICT-related incident under DORA?](https://netsenx.com/en/faq/what-is-a-major-ict-incident-under-dora)
- [What are the DORA incident reporting deadlines?](https://netsenx.com/en/faq/what-are-the-dora-incident-reporting-deadlines)