GDPR isn’t just about data storage—it’s about transport. Every byte that moves must be shielded against interception. That means your TLS configuration is now part of your legal risk profile. Weak ciphers, outdated protocols, and misconfigured certificates can put you out of compliance and into a penalty bracket worth millions.
TLS under GDPR is not optional security. It’s mandatory encryption in motion. Article 32 of GDPR demands “appropriate technical and organisational measures” to secure processing. For data in transit, that translates to using protocols and configurations that meet current cryptographic standards. Outdated TLS versions such as TLS 1.0 and TLS 1.1 fail these requirements. The baseline is TLS 1.2, with preference for TLS 1.3 for stronger security and faster handshakes.
Start with protocol selection. Enable only TLS 1.2 and TLS 1.3. Disable SSL and older TLS versions entirely. Configure cipher suites with forward secrecy—ECDHE for key exchange, AES-GCM for encryption, SHA-256 or stronger for hashing. Avoid CBC ciphers and anything flagged as “weak” by your scanner. Ensure you support modern curves such as secp256r1 or X25519.
Certificate management matters. Use certificates issued by trusted public authorities with SHA-256 or higher signature algorithms. Rotate them before expiry. Implement OCSP stapling to improve revocation checks without slowing connections. If you process personal data, wildcard or SAN certificates should be monitored carefully—misuse is a compliance issue.