GDPR fines don’t wait for innovation. Quantum computers are coming fast, and the encryption protecting personal data under GDPR will not survive them. Every European business storing or processing personal data has a legal duty to keep that data secure—not just today, but against foreseeable threats. Quantum-safe cryptography is now part of that future-proofing.
GDPR requires data controllers and processors to implement “appropriate technical and organisational measures.” Weak encryption against known future threats is not appropriate. Quantum algorithms like Shor’s can break RSA and ECC. This means that the most common encryption methods in use—TLS with RSA, email encryption with ECC—will be vulnerable. Stolen data today can be stored and decrypted later when quantum machines can run these algorithms at scale. GDPR compliance does not just mean meeting the standard as of this year; it requires planning for long-term integrity and confidentiality.
Quantum-safe cryptography, also called post-quantum cryptography (PQC), uses algorithms resistant to both classical and quantum attacks. NIST is finalizing a set of quantum-safe standards, including CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium for digital signatures. These algorithms run on existing hardware, require no quantum computers to implement, and can replace vulnerable keys in systems now. Adopting them will align with GDPR’s requirements for proactive risk mitigation.