GDPR and data hosting: what the law really says about encryption

The General Data Protection Regulation (GDPR) mentions encryption explicitly only once, in Article 32, among the "appropriate technical and organisational measures". It doesn't mandate a specific algorithm — but it mandates an outcome: data security must be proportionate to the risk.

What Article 32 of the GDPR says

Article 32 explicitly cites "the pseudonymisation and encryption of personal data" as an example of an expected technical measure. In practice, for any sensitive data (health, financial, identity data), supervisory authorities treat encryption as an implicit standard, and its absence as a compliance failure in the event of an audit or complaint.

Why zero-knowledge encryption changes the scope of a breach

Article 34 of the GDPR requires notifying affected individuals when a data breach is "likely to result in a high risk" to their rights and freedoms. But this individual notification duty doesn't apply if the exfiltrated data was encrypted and therefore unintelligible to the attacker (Article 34.3.a).

That's the concrete difference between a host that encrypts "at rest" (and holds the key) and a zero-knowledge host like May·Secret: if our servers were compromised, an attacker would only recover files encrypted with keys they can't obtain, since we don't hold them either. The real risk to affected individuals is therefore structurally reduced, which changes the impact assessment and notification obligations.

Hosting in France and transfers outside the EU

Beyond encryption, the GDPR strictly regulates data transfers outside the European Union (Chapter V). Hosting your data with a provider based in France, on infrastructure located in France, considerably simplifies compliance: no standard contractual clauses to negotiate, no dependency on the EU-US Data Privacy Framework and its recurring legal uncertainty.

May·Secret hosts its entire infrastructure in France, and applies end-to-end encryption to every file, on every plan — including the free plan.