GDPR Data Encryption Standards: AES-256 & TLS 1.3

Technical Overview of GDPR Article 32 Encryption

Article 32 of the General Data Protection Regulation (GDPR) mandates the pseudonymisation and encryption of personal data as state-of-the-art technical measures.

Field-Level Encryption (AES-256-GCM)

import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';

export class FieldEncryption {
  private key: Buffer;

  constructor(hexKey: string) {
    this.key = Buffer.from(hexKey, 'hex');
  }

  public encrypt(text: string) {
    const iv = randomBytes(12);
    const cipher = createCipheriv('aes-256-gcm', this.key, iv);
    let encrypted = cipher.update(text, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    const tag = cipher.getAuthTag().toString('hex');
    return { encrypted, iv: iv.toString('hex'), tag };
  }
}

Transport Layer Security (TLS 1.3)

Ensure your web servers enforce TLS 1.3 or high-grade TLS 1.2 with HSTS headers:

ssl_protocols TLSv1.2 TLSv1.3;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;