Client-side encryption reduces the exposure under GDPR; it does not take you out of it

Dinis's memo said that with the data encrypted you do not have to worry about GDPR, and the article corrects it: for whoever holds the keys, encrypted personal data is still personal data, storing it is still processing, and the controller's duties stay (the UK regulator says not to think encrypted data is outside the UK GDPR). What encryption does is reduce the exposure, and the law recognises it: Article 32 lists encryption as a security measure, and under Article 34(3)(a) a breach need not be communicated to the people affected if the data was made unintelligible to anyone not authorised, provided the key was not lost with it. The Court of Justice held in September 2025 that pseudonymised data is not personal data in all cases and for every person, which may help a store that never has the keys. Much less to worry about, not nothing.

Decided by. Nobody yet: a candidate for Dinis to read, comment on and decide (keep, rewrite, merge, cut, article first, later, not doing it).

Note. An instance of asked-to-be-corrected: the memo's claim stands corrected in the article, and the book must not repeat the memo. Sources named in the article: GDPR Articles 32 and 34; ICO encryption guidance; Court of Justice case C-413/23 P, press release of 4 September 2025. Not legal advice. Answers the 2018 outline GDPR, which the map says no article covered for developers.

Where it comes from

The value of constraints What it does not do: GDPR (newsroom)

What it answers in the 2018 book

GDPR answered outline, Concepts

Where it goes

Chapter Privacy by design: SG/Send, sgit, and the value of constraints, part Build it without a server (drafting); topic Security for the agent era: least code, supply chain, secrets, learning to hack.

Other ideas proposed for the same chapter: Git for things you cannot put on GitHub: what an encrypted vault is, One string is address, authorisation and key; the read key derived from it is safe to publish, An app in a vault runs against the vault without ever being handed a key, Encryption on the client moves the problem from the data to the keys, and the sovereignty line to whoever holds them, Where the keys live: a password manager for the keys a person holds, a registry vault for the keys agents make, Append lanes: one POST from anywhere, readable only by the vault's owner, Nobody buys it for the encryption: the features came from the constraint.

Node idea:encryption-does-not-remove-gdpr in graph.json; see it in the graph. Source: admin/content/graph/ideas.json.