Encryption can work as a supplementary measure when the importer only stores data and never needs it in the clear, and the exporter keeps the keys. The EDPB says it cannot envision an effective technical measure when a processor needs readable data and problematic access laws apply.
Use case 1: storage and backup
The EDPB's first use case is a hosting provider in a third country used for backup or storage that does not require access to data in the clear. The Board lists conditions. Strong encryption is applied before transmission and the importer's identity is verified. The algorithm and parameters are state of the art and robust against the resources of public authorities there. Key length reflects how long the data must stay confidential. The software is correctly implemented and maintained. The keys are reliably managed. And the keys are retained solely under the control of the exporter, or an entity it trusts in the EEA or in a jurisdiction offering essentially equivalent protection.
Read that last condition twice. Encryption with the vendor holding the key is not the same measure.
Use case 3: protecting data in transit
Transport encryption protects data in transit from interception by authorities along the route. The Board expects state of the art protocols, a trustworthy certificate infrastructure and protection of the sending and receiving systems. It says that where transport encryption alone is not enough, you should add application layer end to end encryption. Transit protection does not help once the importer holds the data and the keys.
Use case 6: cloud processing in the clear
Here a cloud provider or other processor in a third country needs the data in the clear to do its job. If the third country's authorities can access it beyond what is necessary and proportionate, the Board says that, considering the current state of the art, it is incapable of envisioning an effective technical measure. It also says transport encryption and encryption at rest, taken together, do not suffice if the importer has the cryptographic keys. The Board does not rule out that technology may change this.
What this means for design
- If a vendor only stores blobs, encrypt on your side before upload and keep the keys yourself. See who holds the keys.
- If a vendor must compute on readable data, you cannot rely on encryption alone. Consider minimising fields, choosing a provider and location that avoid the problem, or a different tool.
- Contract terms and certifications help but, according to the EDPB, contractual and organisational measures alone will generally not stop public authority access.
Quick check
Is encryption at rest enough for a US cloud?
Not if the provider holds the keys and needs the data in the clear, according to the EDPB's sixth use case. It depends on who controls the keys and what processing is needed.
Is this legal advice?
No. The Board's document is long and fact specific. Read the use cases with counsel.
Sources
Last reviewed: 19 October 2026.
