A startup asks whether encryption is mandatory in all GDPR processing scenarios as a universal checkbox. Which framing is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Encryption is a heavy hitter, not a participation ribbon that ends the game. You pick measures that fit the risk—and encryption often belongs—but it is not the only play on the field. Risk-based TOMs beat one universal checkbox.
Full Explanation
Encryption is a strongly relevant example of an appropriate measure assessed against processing risk, not a single magical requirement that alone proves compliance in every case. Startups asking whether encryption is a universal GDPR checkbox should treat Article 32 as risk-based: encryption is often essential, yet adequacy still considers context, other TOMs, and residual risk. Encryption is not illegal except for military systems. It is not mandatory for every processing operation with no risk assessment. It does not always replace access control, backups, and organisational measures. Exam caveat: encryption is exemplary and often necessary, but not a solitary automatic proof of Article 32 compliance. Operational check: select encryption for civic personal-data stores based on risk, then verify complementary controls (keys management, access control, backups, training) rather than stopping at “disk encrypted.” For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.