Data Protection and Encryption

You cannot protect data you have not found. Data protection starts with knowing what you hold, where it lives and who can reach it, then applying controls that match its value. SSC helps Australian and New Zealand organisations classify data, design encryption and key management, reduce data leakage and plan the move to post-quantum cryptography.

What our data protection advisory covers

• Data discovery and classification. A classification scheme people will actually use, mapped to where sensitive data really sits, including cloud storage and SaaS applications.
• Encryption and key management. Standards for data at rest and in transit, key ownership, rotation, and storage in hardware security modules or cloud key management services.
• Data loss prevention. DLP policies tuned to your real data flows, for example in Microsoft Purview, so they stop real leaks without stopping work.
• Retention and deletion. Keeping data only as long as you need it, which reduces what a breach can expose.
• Backup protection. Encrypted, access-controlled and tested backups. Regular backups are one of the Essential Eight strategies.
• Post-quantum readiness. A cryptographic inventory and a migration plan.

The rules behind it

Australian Privacy Principle 11 requires organisations covered by the Privacy Act 1988 to take reasonable steps to protect personal information, and the 2024 amendments made clear that those steps include technical and organisational measures. In New Zealand, Information Privacy Principle 5 of the Privacy Act 2020 sets a similar expectation. PCI DSS v4.0.1 Requirements 3 and 4 cover stored account data and strong cryptography in transit. In ISO/IEC 27001:2022, the relevant Annex A controls include 5.12 (classification of information), 5.34 (privacy and protection of personal information), 8.10 (information deletion), 8.12 (data leakage prevention) and 8.24 (use of cryptography).

Planning for post-quantum cryptography

The Australian Signals Directorate recommends that organisations stop using traditional asymmetric cryptography, such as RSA, ECDH and ECDSA, by the end of 2030, and its December 2024 Information Security Manual update approved ML-KEM and ML-DSA. Data stolen today can be decrypted later, so long-lived sensitive data needs attention first. Our article on harvest now, decrypt later explains the risk, and our post-quantum cryptography roadmap for APAC banks sets out the steps.

Related reading: PCI DSS compliance advisory, Microsoft Fabric and Purview for data governance and our notifiable data breach guide.