Encryption can reduce breach notification duties, but it is not an automatic exemption. The FTC Safeguards Rule guidance says encrypted information counts as unencrypted if an unauthorised person accessed the encryption key, and HIPAA's duties turn on unsecured PHI. How much encryption helps depends on the rule. This is education, not legal advice.
Myth: encrypted means nobody can be affected
Fact. Encryption protects data only as well as the key is protected. The FTC guidance says that for the Safeguards Rule, encrypted information is treated as unencrypted if an unauthorised person accessed the encryption key. If the attacker took the database and the key from the same server, the data was effectively exposed.
Myth: our disks are encrypted, so a stolen laptop is safe
Fact. Full disk encryption protects a powered off device. A running, unlocked laptop may expose files. Whether a given loss triggers notice depends on facts such as the device state and key management, and on which rules apply. HIPAA's risk assessment includes whether PHI was actually acquired or viewed and the extent of mitigation. Record the evidence for the device state, such as management logs showing encryption was on.
Myth: if we cannot prove it was taken, we do not have to say anything
Fact. The FTC says unauthorised access to unencrypted information is presumed to be unauthorised acquisition unless reliable evidence shows otherwise. HIPAA similarly presumes an impermissible use or disclosure is a breach unless a risk assessment shows low probability of compromise. Under GDPR, a breach is judged on risk to individuals, and Article 33(5) still requires you to document breaches you decide not to report.
The common thread: when evidence is missing, the presumption tends to work against you. Logs are what turn "we think nothing was taken" into something you can defend.
Myth: one rule's answer applies everywhere
Fact. Rules differ in definitions, thresholds and triggers. The FTC's rule has a 500 consumer threshold. GDPR has a risk test. HIPAA has its presumption and exclusions. A single incident can be reportable under one and not another. See our clock comparison.
What to do about it
- Treat key management as part of the control. Separate keys from data, restrict who can use them, and log key use.
- Keep audit logging on data stores so you can show what was and was not read.
- Keep device management records proving encryption and lock state.
- When encryption is the basis for deciding not to notify, write down why, and have counsel agree.
- Revisit the decision if later evidence shows the key was exposed.
Encryption is still worth doing. It lowers real risk and, depending on the rule, may change what you must do. It just is not a substitute for a documented assessment.
Quick check
Is encrypted data always outside notification rules?
No. Under the FTC Safeguards Rule, encrypted data counts as unencrypted if an unauthorised person accessed the key. Other rules have their own tests.
Do we need to document a decision not to notify?
Under GDPR Article 33(5), yes, you document all breaches. For other regimes, documenting your reasoning is a sound habit.
Sources
Last reviewed: 19 October 2026.
