Definition
Encryption is the process of transforming readable data into an unreadable form using a mathematical algorithm and a secret key, so that only someone with the correct key can turn it back into the original. It protects data in two situations: in transit, while it travels across a network, and at rest, while it sits on a disk or in a database. The padlock in your browser means the connection is encrypted; a stolen laptop with an encrypted drive is a lost asset rather than a data breach.
In a company, encryption is mostly invisible and mostly handled by the platforms you use. Websites and APIs use HTTPS, which encrypts traffic with TLS. Cloud providers encrypt storage by default. Laptops and phones encrypt their disks. Where companies make decisions is in the details: whether sensitive fields such as passwords and identity numbers get extra protection in the database, who holds the encryption keys, and whether messaging and file sharing are end-to-end encrypted so even the provider cannot read the content.
The misconception is that encryption alone makes data safe. It protects data from someone who steals the disk or intercepts the network, but not from someone who logs in with a stolen password and is handed the decrypted data by the application. Encryption is one layer among several. Regulators such as those enforcing GDPR treat properly encrypted data that is lost as a much lower-severity incident, which makes it one of the cheapest risk reducers a company can adopt.
In practice
A sales director's laptop was stolen from a car with a customer list on it. Because the disk was encrypted and the password strong, the company recorded the loss as a hardware replacement, not a data breach requiring notification to customers and the regulator.
Why it matters
Encryption turns a catastrophe into an inconvenience. Make sure every laptop, phone, database and backup in your company is encrypted by default and that someone knows where the keys are; the cost is near zero and the downside protection is enormous.
Frequently asked questions
- What is the difference between encryption at rest and in transit?
- Encryption in transit protects data while it moves across a network, for example between your browser and a website, using protocols such as TLS (the S in HTTPS). Encryption at rest protects data stored on disks, databases and backups, so a stolen drive or leaked file is unreadable. Good security uses both.
- What is end-to-end encryption?
- End-to-end encryption means data is encrypted on the sender's device and only decrypted on the recipient's device, so no intermediary, including the service provider, can read it. Messaging apps such as Signal and iMessage use it. It offers strong privacy but means the provider cannot recover your data if you lose your keys.