In simple terms
Encryption turns readable data into scrambled data using a secret key. The UK data protection regulator describes it as encoding data so that only those with the key can read it.
Reversing the process is decryption. Without the key, the scrambled version should be useless to whoever holds it.
How it works
There are two families. Symmetric encryption uses the same key to lock and unlock. The standard example is AES, a block cipher NIST published in 2001, which works on 128 bit blocks with keys of 128, 192 or 256 bits.
Asymmetric, or public key, encryption uses a pair of keys: a public one anyone can use to encrypt, and a private one that alone can decrypt. Most real systems combine the two.
Two situations matter in practice. Data at rest is encrypted on a laptop, phone or backup drive. Data in transit is protected while crossing a network, by protocols such as HTTPS and TLS. The UK regulator recommends TLS 1.3 and warns against older SSL versions.
Key management decides whether any of this works. Storing the key beside the data defeats the point, and losing the key usually means the data cannot be recovered at all.
Legal duties differ by country. Under UK data protection law encryption is not compulsory, but the regulator treats it as an appropriate security measure that organizations should consider given how cheap and available it now is.
Why it matters
Encryption protects banking, messaging, medical records and government systems every day, almost always invisibly.
It limits the damage when hardware is lost. An encrypted, switched-off laptop leaks far less than an unencrypted one.
It is also contested. The same property that keeps data away from criminals keeps it away from investigators, and governments differ sharply on where that balance should sit.
Where you’ll see it
- The padlock and https in a browser address bar.
- Full disk encryption switched on by default on phones and laptops.
- Messaging apps that advertise end-to-end encryption.
- Wi-Fi passwords, VPNs and payment terminals.
Example
A hospital laptop is stolen from a car. Because the disk was encrypted and the machine was switched off, the thief ends up with a drive of unreadable data instead of a patient list.
Often confused with
Encryption is reversible with the key. Hashing is not. A hash produces a fixed fingerprint used to check that data has not changed, or to store passwords, and the original cannot be recovered from it.
Key facts
- The UK Information Commissioner defines encryption as a process that uses a secret key to encode data, so only those with access to the key can read it.1
- AES, the Advanced Encryption Standard, is a symmetric block cipher published by NIST on 26 November 2001, with an editorial update on 9 May 2023 that made no technical change.2
- AES works on 128 bit blocks and comes in AES-128, AES-192 and AES-256 variants, named for their key lengths.2
- Encryption at rest protects data on devices and media, while encryption in transit protects it crossing networks, where TLS 1.3 is recommended and older SSL versions are not.1
- Under UK data protection law encryption is not mandatory, but is treated as an appropriate technical measure that organizations should consider.1
Related concepts
In the news
Quick checkWhat is the difference between symmetric and asymmetric encryption?Show answer
Symmetric encryption uses one shared key to both encrypt and decrypt. Asymmetric encryption uses a public key to encrypt and a separate private key to decrypt.
Sources
- Information Commissioner's Office, UK. Encryption, a guide to data security. Undated (accessed 18 September 2026)
- NIST. FIPS 197, Advanced Encryption Standard (AES). 26 November 2001, updated 9 May 2023 (accessed 18 September 2026)
Editorially reviewed by Specialty Digest Editorial TeamLast reviewed September 21, 2026Researched and drafted with AI assistanceReport an issue