4 ms·
Isn't it already mandatory as part of GDPR? > the controller and the processor shall implement appropriate technical and organisational measures to ensure a le
by V__ 3y ago
Isn't it already mandatory as part of GDPR?
> the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
(a) the pseudonymisation and encryption of personal data;
[1] https://gdprhub.eu/Article_32_GDPR https://gdprhub.eu/Article_32_GDPR
- bawolff 3y agoThere is a diference between e2ee and just encryption. Article32 seems to only be requiring encryption at rest (and maybe transit) but not e2ee.
- cccbbbaaa 3y agoThe important points here are “Taking into account the state of the art” and “appropriate technical and organisational measures to ensure a level of security appropriate to the risk”. For example, this case is cited in the page linked above: https://gdprhub.eu/index.php?title=IMY_(Sweden)_-_DI-2021-4355 https://gdprhub.eu/index.php?title=IMY_(Sweden)_-_DI-2021-43... > Sending an e-mail containing sensitive data with enforced TLS-encryption instead of end-to-end encryption was deemed insufficient secured under Article 32(1) GDPR.