Secordit home
Contact

What is encryption?

Encryption turns readable information into a form that is unusable without the right key. Someone who gets the file or the traffic still cannot readily use it. Two common places are data in transit, and data stored on a device, backup or disk. Keys can still be stolen, or a person can be tricked into opening something. 123

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. Information is turned into an unreadable form using a key, and can be read again only with the right key. 12
  2. In transit, this often uses HTTPS or TLS between your browser or app and the service. At rest, it can protect files on a device, backup or disk. 31
  3. UK data protection law does not always require encryption in every case. The ICO names it as a technical measure that can form part of appropriate security, depending on the risk. 14

How it can look

The ICO explains encryption as part of a wider defence in depth approach, sitting alongside other measures. Its encryption guidance states that it is under review because of the Data (Use and Access) Act. This is not legal advice. 12

Warning signs

  • A key, password or recovery method for encrypted data is stored insecurely, or shared after a trick. 12
  • A seller claims encryption removes all data-protection risk, or that it is always legally mandatory. 14
  • A laptop, backup or message is treated as safe solely because it is encrypted. 1

What to do now

  1. Use disk encryption where there is a risk of physical theft, such as on a laptop, and protect the sign-in that opens it. 32
  2. Look for HTTPS when you send information to a website, especially for email, banking and shopping. 3
  3. If you handle other people's personal data, read the ICO encryption guidance and treat this page as general information, not legal advice. 14

UK reporting and support

  • If personal data may have been exposed, see the data breach glossary page and the ICO guidance. This entry is not legal advice. 41
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 578
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 6
  • If someone is in danger, call 999. 78

How to protect yourself

  • Protect the keys, passwords and recovery methods that open encrypted devices and files. 23
  • Use encryption as one layer, alongside updates, careful sign-in and backups, rather than as the only control. 1
  • Follow ICO and NCSC guidance if you are deciding how to protect personal data in a business. 134

Frequently asked questions

If my laptop is encrypted, am I still allowed to report a data breach?

Encryption does not remove all risk, and it does not by itself settle whether a breach should be reported. The ICO treats encryption as one technical measure, depending on the risk. Use the ICO guidance, and see the data breach page. This is not legal advice. 14

Does UK law always require encryption?

No. The UK GDPR and the Data Protection Act 2018 require appropriate security. The ICO names encryption as a measure that can form part of that, depending on the risk. It is not always required in every case. 14

Is encryption the same as a password?

No. Encryption changes the information itself so it is unusable without the right key. A password may protect that key, or a sign-in, but a person can still be tricked into opening something. 12

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. ICO, Encryption and data protection | ICO. Accessed 10 November 2026 (Europe/London).
  2. ICO, How do we implement encryption? | ICO. Accessed 10 November 2026 (Europe/London).
  3. NCSC, 10 Steps: Data security | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. GOV.UK, Data protection - GOV.UK. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).