A startup asks whether encryption is mandatory in all GDPR processing scenarios as a universal checkbox. Which framing is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Encryption is a heavy hitter, not a participation ribbon that ends the game. You pick measures that fit the risk—and encryption often belongs—but it is not the only play on the field. Risk-based TOMs beat one universal checkbox.
Full Explanation
Article 32 lists encryption among measures that may be appropriate, evaluated in light of risk, state of the art, and implementation costs. Encryption is therefore a highly relevant control in many scenarios but is not framed as a solitary mandatory checkbox that automatically satisfies security for every processing activity. Other technical and organisational measures remain part of the overall assessment.