GDPR and Long-Lived Personal Data Under Quantum Threat

Short answer: A vendor blog and an OWASP project argue that GDPR Article 32, which requires security measures appropriate to the risk, can reasonably be read to cover "harvest now, decrypt later" for personal data that must stay confidential for decades. This is an interpretation from those sources, not regulator guidance or legal advice. The practical point is simple: data that must stay secret for longer than your migration plus the time until a quantum computer exists is already exposed.

GDPR Article 32 requires controllers to implement security measures appropriate to the risk, a standard that increasingly includes the foreseeable threat of cryptographically relevant quantum computers. Under the harvest-now-decrypt-later model, adversaries can record encrypted traffic today and decrypt it once quantum hardware arrives, exposing any personal data whose confidentiality must outlast that transition.

Why does the harvest-now-decrypt-later threat matter for GDPR compliance?

The core risk is not that a quantum computer will immediately break current encryption, but that encrypted data transmitted today can be stored by an adversary and decrypted later. Under the harvest-now-decrypt-later threat model, an adversary records encrypted traffic now and decrypts it once a cryptographically relevant quantum computer exists. This means that any data whose confidentiality must outlast the arrival of such a machine is exposed from the moment it is transmitted. For GDPR purposes, this is significant because Article 32 requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. While the regulation does not mandate specific algorithms, it does require risk-based measures that account for the state of the art and foreseeable threats. Researchers have identified harvest-now-decrypt-later as a foreseeable threat for personal data with multi-decade sensitivity. Therefore, if an organization holds personal data that must remain confidential for decades, the mere possibility that an adversary could capture that data now and break it later constitutes a risk that must be addressed under the GDPR’s risk-based framework.

How does Mosca’s inequality determine exposure?

To reason about which data categories are most exposed, researchers apply Mosca’s inequality as the operative planning frame. The inequality compares three time variables: the time to migrate to quantum-safe cryptography (X), the required confidentiality lifetime of the data (Y), and the time until a cryptographically relevant quantum computer exists (Z). If the sum of the migration time and the confidentiality lifetime exceeds the time until the quantum computer exists, the organization is already exposed. In other words, if X plus Y is greater than Z, current public-key protection is insufficient. This mathematical relationship highlights that exposure is not solely dependent on the exact arrival date of quantum hardware. Even if the arrival of a cryptographically relevant quantum computer is uncertain, data with long confidentiality requirements may already be at risk if the migration to quantum-safe cryptography is delayed. The inequality thus shifts the focus from predicting the exact timeline of quantum computing to assessing the mismatch between data lifetimes and migration readiness.

Which categories of personal data are most at risk?

The risk is particularly acute for data with multi-decade confidentiality requirements. These include archives, backups, regulated personal data, identity records, intellectual property, and signed material whose integrity must hold for years. Within the context of GDPR, this specifically impacts medical, genetic, and financial data, which often have long confidentiality lifetimes. The threat is most plausible when such data is transmitted over channels where harvest-now-decrypt-later collection is feasible, such as the public internet. Furthermore, the risk is heightened if the processing of this data is likely to continue across the expected horizon of cryptographically relevant quantum computer availability. Data categories that are static or rarely accessed may seem less urgent, but if their confidentiality requirement extends past the projected arrival of quantum hardware, they cannot be protected by today’s public-key primitives alone. The distinction is critical: it is not just about data that is actively processed, but about data that must remain secure for a duration that outstrips the current cryptographic era.

What are the limitations of current public-key protection?

Current public-key algorithms are the standard for protecting most digital communication, but they are vulnerable to cryptographically relevant quantum computers. The limitation is not merely theoretical; it is a practical constraint on the longevity of security guarantees. Data with a confidentiality requirement that extends past the projected arrival of a cryptographically relevant quantum computer cannot be protected by today’s public-key primitives alone. This insufficiency exists regardless of exactly when a cryptographically relevant quantum computer arrives. The uncertainty of the timeline does not eliminate the risk; rather, it complicates the planning horizon. Organizations cannot rely on the assumption that quantum computers are decades away to justify ignoring the threat for long-lived data. If the migration time to quantum-safe cryptography is long, or if the data lifetime is very long, the inequality shows that exposure is already present. Thus, the limitation of current protection is that it offers no guarantee for data that must remain secure beyond the transition period to post-quantum cryptography.

How should organizations interpret Article 32 in this context?

One of the sources argues that post-quantum cryptography becomes a reasonable interpretation of Article 32 when specific conditions are met. First, the personal data must have a long confidentiality lifetime, such as medical, genetic, or financial records. Second, the data is transmitted over channels where harvest-now-decrypt-later collection is plausible, such as the public internet. Third, the processing is likely to continue across the expected horizon of cryptographically relevant quantum computer availability. When these conditions align, the source argues that failing to consider post-quantum migration could be seen as failing to implement measures appropriate to the risk. The GDPR’s requirement for risk-based measures implies that organizations must assess the likelihood and impact of foreseeable threats. Since harvest-now-decrypt-later is a documented threat model for long-lived data, ignoring it for such categories may not meet the standard of Article 32. This interpretation does not require immediate deployment of post-quantum algorithms for all data, but it does require that organizations assess their data lifetimes against their migration readiness. The responsibility lies in aligning the technical measures with the actual confidentiality requirements of the data held, ensuring that long-lived personal data is not left exposed by the gap between current cryptographic capabilities and future quantum threats.

FAQ

What does GDPR Article 32 require?

Controllers and processors must implement technical and organisational measures appropriate to the risk.

Does Article 32 require post-quantum cryptography?

Not explicitly. The sources reviewed argue it can be a reasonable interpretation for data with a long confidentiality lifetime sent over channels where collection is plausible. That is an argument, not a regulator ruling. Ask a lawyer or your data protection officer.

What is "harvest now, decrypt later"?

An adversary records encrypted traffic now and decrypts it once a cryptographically relevant quantum computer exists. Data whose confidentiality must outlast that point is exposed from the moment it is sent.

What is Mosca's inequality?

A planning rule comparing migration time (X), required confidentiality lifetime (Y) and time until a cryptographically relevant quantum computer exists (Z). If X plus Y is greater than Z, current public-key protection is insufficient.

Which personal data is most exposed?

Data with multi-decade confidentiality needs, such as medical, genetic, financial and identity records, archives and backups.