Data Encryption: What Should Be Encrypted and How Do You Do It in Practice?

Encryption sounds like something from a spy film. In practice, it is one of the most concrete and effective protection mechanisms a Danish company can activate, and large parts of it are already built into the systems you use every day. It is simply a matter of turning it on.

What Is Encryption, Really?

The easiest way to understand encryption is to imagine a lock on a box. You place your data in the box and lock it. Without the key, the contents are completely illegible, even if someone physically takes the box away. Encryption does exactly the same thing digitally: it transforms your files into an unrecognizable jumble of characters that can only be read with the correct cryptographic key.

In practice this means that if a hacker or a thief gains possession of your hard drive, your files or your USB drive, they are completely powerless, as long as encryption is enabled and the key has not been compromised.

Encryption in Transit vs. Encryption at Rest

There are two situations in which your data can be intercepted or stolen: while it is moving (in transit), and while it is sitting still (at rest). Both require protection.

Encryption in Transit protects data while it is sent from one place to another: for example, from your browser to a website, or from your employee to your mail server. The HTTPS protocol does this automatically for web pages. Email is more complex and requires setting up TLS or S/MIME to be properly protected end-to-end.

Encryption at Rest protects data that is stored: on a hard drive, in a cloud folder or on a USB drive. This form of encryption is the one most companies overlook, and it is precisely here that the greatest consequences arise when a laptop goes missing.

What Happens When an Encrypted Laptop Is Stolen?

Let us take a concrete example: your sales representative forgets her laptop on a train. Two scenarios:

Without encryption: Whoever finds the computer connects the hard drive to another machine and has full access to all files, customer databases, quotes, contracts and emails. Within minutes. A GDPR fine is a real possibility, and you are obliged to report it to the Danish Data Protection Agency (Datatilsynet).

With encryption: Whoever finds the computer sees only encrypted data. Without the password and the encryption key, there is nothing to access. You report the lost equipment, wipe it remotely via your MDM solution, and the case is effectively closed from a data protection perspective.

The difference is critical, both for your company's reputation and for your responsibility under GDPR.

BitLocker: The Most Obvious Place to Start

If your employees use Windows computers, you already have access to BitLocker. It is Microsoft's built-in encryption tool, and it is built directly into Windows 10 Pro and Windows 11 Pro. You do not need to buy anything extra.

BitLocker encrypts the entire hard drive. When the computer starts up, the user must enter a PIN code or use a TPM chip (a small security chip built into most modern computers) to unlock it. The rest happens automatically and is barely noticed by the user in everyday use.

Here's how to enable BitLocker on a Windows computer:

1. Go to Control Panel → System and Security → BitLocker Drive Encryption
2. Click "Turn On BitLocker" next to the drive you want to encrypt
3. Choose how you want to unlock the drive (recommended: password + TPM)
4. Save a backup of your recovery key: in your Microsoft account, on a USB drive, or printed out
5. Choose whether you want to encrypt only used space (faster) or the entire drive (more secure)
6. Encryption then runs in the background

Cloud Storage and USB Drives

Many companies believe that because they use OneDrive or SharePoint, their data is automatically encrypted. This is partly true: Microsoft encrypts data in its data centers. However, this does not protect against an employee sharing a file with incorrect permissions, or an account being compromised by a hacker.

For USB drives, the situation is even more critical. An unencrypted USB drive left in a parking lot is an open invitation. Use either encrypted USB drives (hardware-encrypted models from Kingston or SanDisk, for example), or avoid USB drives for sensitive data altogether and stick to encrypted cloud storage.

For email, it is recommended to ensure that your mail server communicates via TLS. This is the default setting in Microsoft 365 and Google Workspace, but it is worth verifying that it is active.

GDPR and Encryption Requirements

GDPR explicitly mentions encryption as one of the technical measures companies should implement to protect personal information. It is not a legal requirement in all cases, but it is a strong protective factor when the Danish Data Protection Agency assesses whether a company has acted responsibly.

In concrete terms this means: if your company processes personal data (and every company with employees and customers does), then devices containing such data should be encrypted. Laptops, servers and cloud storage are at the top of the list.

Get Started Today

It does not need to take long. Start with the most obvious:

• Enable BitLocker on all Windows laptops in the company
• Make sure Mac users have FileVault enabled (Apple's equivalent encryption tool)
• Ban unencrypted USB drives for sensitive data
• Verify that your mail server uses TLS
• Check that access permissions in OneDrive and SharePoint are set correctly

Encryption is not a guarantee against all attacks, but it does turn a large category of incidents (theft and hardware loss) into non-events. It is one of the most cost-effective forms of insurance your company can purchase.