Encryption and Key Protection: Does Encryption Exempt You from Security Incident Notification Obligations under the GDPR and CRA?
Encryption is one of the most fundamental technical measures that developers implement in a product. However, even where encryption and key protection are in place, a security incident or personal data breach may occur, triggering certain notification obligations under the GDPR and CRA. This article examines these notification obligations and explains how the implementation of encryption and key protection affects the need to report an incident.
GDPR Notification Obligations: Conditions and Exceptions
Before taking steps to address a data breach, the controller must first determine whether the incident actually constitutes a personal data breach. Article 4(12) of the GDPR defines a personal data breach as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”.
A personal data breach is a type of security incident.
The GDPR imposes two notification-related obligations on a controller in the event of a personal data breach: notification to the supervisory authority (Article 33) and communication to data subjects (Article 34).
Notification to the Supervisory Authority
With regard to notification to the supervisory authority, there is only one situation in which the obligation under Article 33 of the GDPR does not apply to a controller: where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The European Data Protection Board’s Guidelines 9/2022 explain that a confidentiality breach involving personal data encrypted using a state-of-the-art algorithm is still a personal data breach and, in principle, requires notification. However, if the confidentiality of the encryption key remains intact, that is, the key was not compromised and was generated in such a way that it cannot be ascertained by available technical means by any person who is not authorised to access it, the data are, in principle, unintelligible.
Consequently, where personal data have been made essentially unintelligible to unauthorised parties and the data are a copy or a backup exists, a confidentiality breach involving properly encrypted personal data may not need to be notified to the supervisory authority.
This is because such a breach is unlikely to pose a risk to the rights and freedoms of natural persons. However, if the encryption key is subsequently compromised or a vulnerability in the encryption is discovered, notification may become mandatory for the controller.омпрометований або буде виявлена вразливість у шифруванні, тоді повідомлення буде обов’язковим для контролера.
Communication to Data Subjects
In certain cases, in addition to notifying the supervisory authority, the controller is also required to communicate the breach to the individuals affected by the personal data breach. The GDPR provides that communication of a personal data breach to data subjects must take place without undue delay, that is, as soon as possible.
Article 34(3) of the GDPR provides for three exceptions under which communication to data subjects is not required:
- The controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the breach, in particular measures that render the personal data unintelligible to any person who is not authorised to access them, such as encryption.
- The controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise.
- Communication would involve disproportionate effort on the part of the controller. In such a case, there must instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.
Thus, the GDPR expressly provides that where data are encrypted, communication to data subjects may not be required. However, it is important to remember that even if notification is not initially required because there is no risk to the rights and freedoms of natural persons, the situation may change over time and the risk may need to be reassessed. If the supervisory authority determines that the controller’s decision not to communicate the breach to data subjects was unjustified, it may consider exercising its available powers and imposing sanctions.ляти суб’єктів даних є необґрунтованим, він може розглянути можливість застосування наявних у нього повноважень та санкцій.
Cyber Resilience Act and Its Reporting Obligations
The CRA sets out both requirements regarding the reporting of supervisory authorities in the event of actively exploited vulnerabilities or severe incidents, and essential cybersecurity requirements, which include provisions regarding encryption in Annex I.
These stipulate that products with digital elements must be designed, developed and manufactured in such a way as to, in particular, ensure the confidentiality of data (including personal and other data) that is stored, transmitted or otherwise processed, for example by encrypting the relevant data using state-of-the-art mechanisms, as well as by employing other technical measures. Encryption will also help ensure compliance with the requirement to report data corruptions and to protect the integrity of stored, transmitted or otherwise processed data against any unauthorised manipulation or modifications not authorised by the user. It is also important to bear in mind that devices designed for secure cryptoprocessing are qualified as critical products containing digital components, which imposes additional certification requirements on such products.
From 11 September 2026, manufacturers of products with digital elements are required to report actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements.
| Manufacturers must submit an early warning within 24 hours of becoming aware of the vulnerability and a full notification within 72 hours. A final report must be submitted no later than 14 days after a corrective measure becomes available for an actively exploited vulnerability and within one month of submitting the 72-hour notification for a severe incident. |
Under Article 24(3) of the CRA, reporting obligations also extend to open-source software stewards starting from 11 December, 2027. Reports should be submitted to ENISA (the European Union Agency for Cybersecurity) and the CSIRT designated as coordinator through a single reporting channel rather than separately to each national authority. That channel is the Single Reporting Platform (SRP), established, operated and maintained by ENISA pursuant to Article 16 of the CRA.
Although the CRA requires manufacturers of products with digital elements to protect the confidentiality of data being processed, including personal data, through measures such as encryption, its reporting obligations provide for no exemptions based on encryption. Encryption may, of course, help prevent the occurrence of an actively exploited vulnerability or a severe incident. However, once either of these two reportable events occurs, reporting is mandatory regardless of whether encryption is in place. The CRA introduces strict penalties for non-compliance with essential cybersecurity requirements (including those stipulating encryption as a technical measure) and reporting obligations, namely a fine of up to 15 000 000 EUR or 2.5% of the undertaking’s global turnover, whichever is the higher. The violation of provisions on the certification of cryptoprocessing devices, which are critical products containing digital elements, carries a fine of up to 10 000 000 EUR or 2% of the undertaking’s global turnover.
Practical Checklist
In the event of a security incident, it is important to have a clear algorithm of steps for determining the precise scope of obligations under the GDPR and CRA. The following sample checklist will help you assess the nature, risks and particular circumstances of a security incident.
| ☐ You have become aware of the security incident and determined whether it involves personal data and whether it constitutes a personal data breach within the meaning of the GDPR. ☐ You have confirmed that the encryption was state of art, robust and properly implemented. ☐ You have determined whether the encryption key was compromised and whether malicious actors could ascertain it by available technical means. ☐ You have established whether personal data were lost, whether a backup exists and whether the data can be restored. ☐ You have assessed the risks arising from the personal data breach, taking into account the type of breach; the nature, sensitivity and volume of the personal data; the ease of identifying data subjects; the number of data subjects affected; and the specific characteristics of both the controller and the data subjects. ☐ You have decided whether to notify the supervisory authority. In cases of doubt, it is advisable to notify the supervisory authority of the breach. You have also identified the appropriate supervisory authority and the means of notification. ☐ You have determined whether the security incident involves an actively exploited vulnerability or a severe incident within the meaning of the CRA. ☐ Depending on the type of incident, you have submitted the report to ENISA and the relevant CSIRT through the Single Reporting Platform (SRP) within the applicable deadlines (24 hours for an early warning, 72 hours for a notification, and 14 days/one month for a final report). |
Conclusions
Both legal instruments impose stringent obligations on data controllers and manufacturers of products with digital elements to report different types of security incidents.
In the context of the GDPR, controllers should carefully assess the quality and reliability of the encryption they have implemented, understand the level of protection it actually provides, and determine whether that level is appropriate to the existing risks. Controllers should also understand the specific features of how their encryption solution operates. If a data breach does occur, they must determine whether the incident constitutes a personal data breach and assess the risks to data subjects, with the possibility of reassessing those risks in the future.
Under the Cyber Resilience Act, encryption does not exempt manufacturers from the obligation to report actively exploited vulnerabilities and severe incidents. Nevertheless, encryption is an important (and even mandatory!) element of addressing cybersecurity risks that can help prevent security incidents in the future.
