my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption.
Can you be GDPR complaint ( in theory) with zero encryption?
Can you be GDPR complaint ( in theory) with zero encryption?
Generally speaking, encryption is an obvious choice when it comes to measures designed to protect user data.
In fact, encryption (security) is mostly orthogonal to how you track and handle personal and sensitive data (privacy protection). You could encrypt everything and still be wildly GDPR non-compliant, if the encrypted information you're storing lacks clear purpose and explicit consent.
We store data encrypted because it
A) leaves no room for misunderstanding with different regulators or their respective auditors, and
B) provides a computationally infeasible barrier against accidental personal information disclosure even if the storage system was improperly decommissioned
Point B in particular can be explained to auditors without problems. They understand both the intent and the technical measures put in place. But how we store data is only tangentially relevant to how we handle data. Let alone what we need to collect in the first place.
(The KYC/AML/SOW requirements in gambling are quite demanding; they impose significant data collection and retention needs.)