Under the GDPR, a laptop with full-disk encryption is stolen and its key is held elsewhere; must anyone be notified?

## Two thresholds, two audiences The GDPR sets different thresholds for its two notification duties: | Duty | Article | Trigger | Deadline | |---|---|---|---| | Notify the **supervisory authority** | Art. 33(1) | always, *unless* the breach is unlikely to result in a risk | without undue delay, where feasible within 72 hours of awareness | | Communicate to **data subjects** | Art. 34(1) | only when the breach is likely to result in a **high risk** | without undue delay | | Document the breach | Art. 33(5) | every breach | no deadline in the text; the record must let the authority verify compliance | The EDPB calls the Art. 34 threshold "higher" on purpose: it spares people notification fatigue. So a breach can be notified to the authority without being communicated to individuals. The order can also invert: the guidelines say that in exceptional cases urgent communication to individuals may come before the authority is notified. ## Applying it to the stolen laptop **Step 1: is it a breach?** Yes. A device holding personal data was lost to an unauthorised person. The encryption changes the risk, not the classification. **Step 2: is it likely to result in a risk?** EDPB Guidelines 9/2022 give this exact case as one that does **not** need notifying: *a securely encrypted mobile device is lost, the encryption key remains in the controller's secure possession, and the device is not the sole copy of the personal data*. Each condition closes a different door: - **effective encryption** means the thief cannot read the data, so there is no confidentiality risk; - **the key held elsewhere and uncompromised** keeps it that way; - **another copy of the data** means the controller has not lost access to it, so there is no availability risk. Without that copy the theft could still be a notifiable availability breach. **Step 3: high risk and Art. 34(3).** Even where there is some risk, **Art. 34(3)** lists three conditions that remove the duty to tell individuals: 1. **(a)** appropriate protection measures were applied to the affected data, *"in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption"*; 2. **(b)** subsequent measures ensure the high risk *"is no longer likely to materialise"*; 3. **(c)** individual contact would involve **disproportionate effort**, in which case a public communication or similar, equally effective measure is required instead. Note what Art. 34(3) does *not* do: it is an exemption from telling **individuals**. Whether the **authority** is notified depends only on the Art. 33(1) risk test. ## Where the encryption argument breaks The guidelines warn that encryption only helps if it actually protected the data at the moment of loss: - a device can be encrypted when **switched off but not in stand-by**, so a laptop stolen while asleep may be readable; - some products ship with **default keys** that each customer must change; - a **key stored with the device**, for example in a file on the same disk, gives no protection; - an algorithm that was adequate may become **outdated**. A controller that skips notification when the data was not in fact securely encrypted fails to comply with Art. 33. And if the key is later found compromised, or a flaw appears in the encryption software, the risk must be **reassessed** and notification may become due. ## What the record should show Under **Art. 33(5)** the controller records the facts, effects and remedial action. For a decision *not* to notify, the EDPB recommends also recording the reasoning, and if an Art. 34(3) condition is relied on, the evidence for it. That means the encryption status at the time of theft, where the key lived, and that the data exists elsewhere. ## What individuals are told when Art. 34 applies If the high-risk threshold is met and no exception applies, **Art. 34(2)** requires the communication to describe the breach *"in clear and plain language"* and include at least the items in Art. 33(3)(b), (c) and (d): a contact point, the likely consequences, and the measures taken or proposed. Under **Art. 34(4)** the supervisory authority may require the controller to communicate, or may decide that an Art. 34(3) condition is met.