Engineers ask whether encrypting personal data before it leaves the EEA can help address transfer risks to a challenging third country. Which authority’s transfer guidance is commonly used to frame that supplementary-measures analysis?
Select an answer to reveal the explanation.
Short Explanation
When people ask “does encrypting before export help?”, the practical playbook many teams open is EDPB transfer guidance—not a tourism brochure. Encryption can be a strong supplementary measure when keys stay out of the bad-access zone. Pair the tech with the legal analysis the EDPB themes describe.
Full Explanation
EDPB recommendations on supplementary measures—issued in the wake of Schrems II—are the commonly tested authority framing how encryption and other technical, contractual, and organisational measures fit transfer risk mitigation. Engineers asking whether encrypting personal data before export helps should be pointed to that guidance: encryption can be powerful when keys are controlled so that third-country recipients or authorities cannot realistically access cleartext. Public bodies and private exporters use the same EDPB logic to argue essential equivalence in practice.
National tourism boards do not publish binding Chapter V encryption standards. OECD Guidelines do not automatically convert encryption into an adequacy decision. Encryption measures are not forbidden once SCCs are signed; they often complement SCCs.
Exam caveat: weak encryption with keys available to the non-adequate processor may not qualify as an effective supplementary measure. Consider key location, algorithm strength, and who can compel disclosure.
Operational check: design export encryption with key custody outside the challenging jurisdiction where feasible, cite EDPB measure categories in the TIA, test restore procedures, and reject “we turned on TLS” as the entire supplementary-measures story for data at rest abroad.