encryption gdpr
Is client-side encrypted data really personal data
<p>Scenario: My service that is storing customer files is hosted on my own personal physical server, “on-prem”. It is then using one of the popular cloud storage services (Azure blob storage, AWS S3) to store these customer files. They may or may not contain personal data.</p>
<p>Before the data is sent from my server to the cloud service the data is encrypted with my secret keys that are only ever stored on the on-prem-server.</p>
<p>Since I am using an encryption algorithm that is considered secure and the keys never goes to the cloud, would the data I send to Azure/AWS be considered personal data under GDPR? Would I for example have to include the storage service as a sub-processor in my published list of sub-processors?</p>

<p>Since you are able to encrypt the data, the data is clearly personal data for you. That means you will have to comply with the GDPR regarding how you process and store this data. This involves disclosing recipients of this data per Art 13(1)(e), and only engaging data processors in line with Art 28.</p>
<p>Your storage provider such as Azure and AWS cannot decrypt this data, so it would not be personal data if processed by them for their own purposes. There is an argument that they did not receive personal data, especially considering the definition of a recipient in Art 4: a person/entity “to which the personal data are disclosed”.</p>
<p>However, this is not necessarily relevant when talking about sub-processors. A processor is anyone who “processes personal data on behalf of the controller”. As processors, they're not using the data for their own purposes but are just acting on your behalf. Storage is a kind processing, and they are storing data on your behalf. This data is personal data for you. Thus, I'd consider the storage providers to be your processors.</p>
<p>Due to your use of strong client-side encryption, your remaining compliance obligations are mostly boilerplate (signing a data processing agreement per Art 28, sorting out international transfers if necessary, and getting agreement for adding a sub-processor from your controllers). Note that encryption is mandatory whenever appropriate (Art 32(1)(a)).</p>
<p>Such client-side encryption could even serve as a legal basis for storing the data in jurisdictions that don't offer an adequate level of data protection, such as a data center in the US. Per the <a href="https://edpb.europa.eu/our-work-tools/public-consultations-art-704/2020/recommendations-012020-measures-supplement-transfer_en" rel="nofollow noreferrer">draft EDPB recommendations on measures that supplement transfers tools</a> (published as a response to Schrems II / the invalidation of Privacy Shield):</p>
<blockquote>
<p>Use Case 1: Data storage for backup and other purposes that do not require access to data in the clear</p>
<p>79. A  data  exporter  uses  a hosting  service  provider  in a third  country  to  store  personal  data,  e.g., for backup purposes.</p>
<p>If</p>
<ol>
<li>the personal data is processed using strong encryption before transmission,</li>
<li>the encryption algorithm and its parameterization (e.g.,key length, operating mode, if applicable) conform to the state-of-the-art and can be considered robust against cryptanalysis performed by the  public  authorities  in  the  recipient  country  taking  into  account the  resources  and  technical capabilities (e.g.,computing power for brute-force attacks) available to them,</li>
<li>the  strength  of  the  encryption  takes  into  account  the  specific  time  period  during  which  the confidentiality of the encrypted personal data must be preserved,</li>
<li>the   encryption   algorithm   is flawlessly   implemented   by   properly maintained   software   the conformity  of  which  to  the  specification  of  the  algorithm  chosen  has  been  verified,  e.g.,  by certification,</li>
<li>the keys are reliably managed (generated, administered, stored, if relevant, linked to the identity of an intended recipient, and revoked), and
6.the keys are retained solely under the control of the data exporter, or other entities entrusted with this task which reside in the EEA or a third country, territory or one or more specified sectors within a third country, or at  an international organisation for which the Commission has established in accordance with Article 45 GDPR that an adequate level of protectionis ensured,</li>
</ol>
<p>then the EDPB considers that the encryption performed provides an effective supplementary measure.</p>
</blockquote>
