device security

A stolen device does not have to mean exposed data. A data encryption policy for UK businesses should explain which information and devices are protected, how encryption keys are managed, and how data is secured in cloud services. UK GDPR identifies encryption as an example of an appropriate technical measure, but encryption alone does not guarantee compliance.

Encryption is an important protection to consider. The challenge is applying it across laptops, mobiles, removable storage and cloud platforms without losing access to important data. This guide explains how encryption helps protect lost or stolen devices, how it relates to GDPR, and why key management matters. It also explores what end-to-end encryption means when a cloud provider stores or handles your information, helping you make informed decisions about protecting business data.

How does encryption protect lost or stolen devices?

Encryption makes information on a device unreadable without the right key. If someone takes an encrypted laptop or mobile, they may possess the hardware but not usable personal data. Device encryption should cover storage, including files saved locally, and activate consistently across the organisation’s equipment. UK data protection is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which require careful handling of personal data.

There is no single encryption specification for every UK industry. Finance, healthcare and government suppliers may face different sector rules, contractual terms and information risks, so organisations need to match controls to the data and obligations involved. The UK Data Service says 128-bit encryption should ideally be the minimum, and that 256-bit encryption is stronger than 128-bit. Derbyshire County Council requires desktop and laptop operating system images to use at least AES 128-bit symmetric-key encryption. Data protection officers may use ISO/IEC 27001, named by the International Organization for Standardization, when assessing state-of-the-art data protection.

Encryption also depends on protecting its keys. Keep keys separate from the encrypted data, limit access to authorised custodians, and document how recovery works. Escrow or another secure recovery arrangement can help restore access if a key is lost. But key deletion can make encrypted backups unusable. In backup reviews, 29% had no protection against key deletion, making deletion safeguards and tested recovery important parts of data security.

Losing an unencrypted device does not automatically mean every incident must be reported to the ICO. UK businesses should assess whether the personal data breach is likely to risk people’s rights and freedoms. The data’s sensitivity, exposure and likely impact all inform that decision. Lack of encryption can increase potential harm, so document the assessment and act according to the reporting threshold.

Incident response matters alongside device controls. The Department for Science, Innovation and Technology’s Cybersecurity Breaches Survey 2023 reports that 21% of UK businesses and 16% of UK charities have formal incident response plans ready. A plan can assign responsibility for reporting a lost device, containing access and reviewing key recovery.

Is encryption required for GDPR compliance?

UK GDPR doesn’t require encryption for every record or system. Article 32 names encryption as an example of an appropriate technical measure. Organisations should select security controls according to the information they process and the risks to people. Sensitive health details, for example, call for careful protection against unauthorised access, loss or disclosure. The Data Protection Act 2018 also requires personal data to be processed securely.

Encryption is one part of a risk-based security approach, not a substitute for one. Consider where personal data is stored, who can access it and how it moves between systems. A customer file sent to a remote employee needs protection in transit and at its destination. Access restrictions, secure devices and staff procedures can support encryption and address risks that encryption alone cannot prevent.

Secure communications deserve particular attention. Emailing sensitive information over a public network can expose it if the message or recipient’s account is compromised. Encryption or a secure channel can protect information in transit, while access controls help prevent unintended reading after delivery. Organisations should also ensure attachments, shared links and mobile access follow consistent safeguards.

Encryption can help organisations retain control when a cloud provider stores or processes their data. Appropriate encryption and key-management controls can reduce reliance on the provider’s security alone. The right arrangement depends on who holds the keys, how access is granted and whether authorised staff can recover information when needed. The provider’s protections and the organisation’s controls should work together.

UK GDPR Recital 83 concerns security of processing, while Article 6 concerns lawful processing. Encryption supports security, but it doesn’t establish a lawful basis for using personal data. A practical policy connects data types, storage locations, communication methods and access rules. A risk-based security review can help identify where those controls need to align across remote work and cloud use.

How do you manage encryption keys?

Encryption protects data only if its keys remain secure and recoverable. Effective key management defines who controls each key, where it is stored and how access can be restored.

Centralised Key Management and Recovery

Centralised key management governs encryption keys through a coordinated system rather than scattered devices or individual accounts. It gives an organisation a clearer view of ownership, access and recovery across its networks and hardware. A documented custody model should name authorised custodians and explain how they recover keys during an incident. Keep key material separate from production systems, and ensure recovery arrangements include encrypted backups.

Customer-managed keys give an organisation direct responsibility for controlling the keys used by a cloud service. This can strengthen control over access, but makes secure storage and recovery essential. If a key is deleted or lost, encrypted data may become inaccessible. Use secure escrow or another protected recovery method, and test restoring both keys and data to support business continuity.

Key Management Costs and Recommendations

The work can assess custody, access, storage and recovery arrangements. ISO 27001 provides detailed information on cryptographic controls, key management, secure communications and encryption risk governance. For NCSC-related practice, focus on documented ownership, restricted access, separation from production and tested recovery, rather than assuming certification alone proves effective controls.

Recovery testing should cover the full chain: retrieve the key, restore encrypted data, and confirm authorised users can access it. Record the result and repeat the test after material system or staffing changes. Backup reviews found that 58% of businesses could not immediately say who held their backup encryption keys, while only 1 in 10 had tested recovering keys as well as restoring data. Clear custody and rehearsed recovery turn key protection into a workable cybersecurity control.

End-to-end encryption and cloud providers

End-to-end encryption protects information from the moment it leaves one authorised device until it reaches another. The encryption keys remain with the communicating endpoints, so a cloud provider handling the message cannot read its contents. This differs from encryption at rest, where a provider may manage the keys and could potentially access data while providing storage or recovery services.

Choose an encryption method according to what the cloud service needs to do. A team sharing a confidential document may need provider tools to search, edit or restore files. These features can require the provider to process readable data. End-to-end encryption can limit that access, but may constrain collaboration and recovery. Map each use case, such as email, file sharing or backup, to the information’s sensitivity and the functions required.

Key control affects the consequences of a provider compromise. If the provider holds usable keys, unauthorised access to its systems could expose readable information. Keeping keys under organisational control can reduce that exposure, but lost keys may make data unrecoverable. Specify who can authorise access, how recovery works and how key custody changes when staff leave. Test the arrangements against a realistic incident, including a lost or stolen device.

The UK Government is pursuing changes to the Investigatory Powers Act that could allow law enforcement and security services to bypass cloud providers’ end-to-end encryption and access private communications more easily and with greater scope. It is therefore important to understand how a service’s encryption works, who controls its keys and what access remains possible. A clear policy should record those decisions and the data each service handles.

For cloud systems where key control, access and recovery need joined-up planning, discuss your cloud security requirements.

Cornerstone Business Solutions

Cornerstone Business Solutions can help bring encryption decisions together across devices, cloud services and everyday business systems. Turn to the team when you need to understand where personal data is stored, how access is controlled, and how key management fits your wider security approach. Its Cyber Security and Managed IT Support offerings can support a practical review, while Microsoft 365 and Cloud Solutions relate to the platforms many organisations use to store and share information.

A clear plan should connect data protection with business continuity, including how authorised users regain access if a key is lost. Cornerstone Business Solutions can help you consider these requirements alongside your existing technology and working practices.

Contact Cornerstone Business Solutions to discuss your encryption and data security needs.

Make encryption part of everyday decisions

A practical data encryption policy for UK businesses should evolve as working practices change. New devices, cloud tools and staff responsibilities can affect where information is held and who needs access. Treat encryption as an ongoing part of technology planning, not a document left untouched after approval. Regular reviews keep security decisions aligned with real working practices.

Cornerstone Business Solutions can help businesses consider encryption within their wider technology environment. Its Managed IT Support, Microsoft 365 and Cyber Security offerings can support joined-up thinking about systems, access and data protection. The right next step is a conversation about your current setup and the areas you want to strengthen.

Contact Cornerstone Business Solutions to discuss your encryption requirements and plan a confident way forward.

Frequently Asked Questions

Is encryption something for businesses to worry about?

Yes, particularly if your organisation handles customer records, staff details or confidential files. A data encryption policy for UK businesses can clarify how that information is protected if a device or account is accessed without permission. For example, a lost work mobile containing email attachments presents less exposure when its storage is encrypted. Treat encryption as one part of wider cybersecurity planning, alongside access controls and staff procedures.

What is data encryption?

Data encryption transforms readable information into coded text that requires a key to unlock. For example, a document containing payroll details becomes unreadable to someone who obtains it but lacks the correct key. Encryption can protect entire device storage or selected files, and can also apply while information moves between systems. The approach chosen affects what users can access and how they recover information.

How does encryption work with cloud storage?

Cloud storage may encrypt information as it travels to the service and while it is stored there. The practical difference is who controls the keys and whether the provider’s tools need to process readable files. For example, end-to-end protection can limit a provider’s ability to read a shared document, while losing the key may prevent your team from recovering it. Consider access, collaboration and recovery together.

What’s the difference between device encryption and file encryption?

Device encryption protects information across a device’s storage, while file encryption applies to selected documents or folders. If a laptop is lost, whole-device protection can cover locally stored work files. A separately encrypted contract can remain protected when copied to a USB drive or shared outside the laptop. Organisations often consider both approaches because files move between devices and storage locations.

What UK laws require businesses to encrypt personal data?

The UK GDPR and Data Protection Act 2018 require organisations to protect personal data with appropriate security measures, but encryption isn’t automatically required for every record. A data encryption policy for UK businesses should connect the safeguards chosen to the information and risks involved. For example, an organisation handling sensitive personal data may need stronger protection than one holding non-sensitive material. Encryption is one possible technical measure.

What does UK GDPR say about encryption and appropriate security measures?

UK GDPR Article 32 identifies encryption as an example of an appropriate technical measure for protecting personal data. It doesn’t make encryption a standalone guarantee of compliance. Organisations should consider their processing, the likelihood and impact of risks, and the other controls protecting information. For instance, encrypting a file won’t prevent misuse by someone who has legitimate access but no longer needs it.