Encryption is the process of converting readable data (plaintext) into an unreadable form (ciphertext) using a mathematical algorithm and a secret key. Only someone with the correct key can reverse the process and read the original data. Encryption protects three things: confidentiality (only authorised parties can read the data), integrity (any tampering with ciphertext is detectable), and authentication (the sender's identity can be verified). Modern encryption is built into almost every digital interaction — HTTPS browsing, messaging apps, banking, file storage, VPNs, and corporate networks.

Three categories: (1) Symmetric encryption — same key for encrypt and decrypt, fast, used for bulk data (AES-256 is the standard, ChaCha20 for modern protocols), (2) Asymmetric (public-key) encryption — separate public and private keys, slower, used for key exchange and digital signatures (RSA-2048+, ECC curves like P-256, P-384, Curve25519), (3) Hashing — one-way function for integrity and password storage (SHA-256, SHA-3, BLAKE3, Argon2 for passwords). Modern protocols combine all three: TLS 1.3 uses asymmetric for key exchange (X25519), symmetric for bulk traffic (AES-GCM), hashing for integrity (SHA-256).

Database encryption protects stored data through several mechanisms: (1) Transparent Data Encryption (TDE) — encrypts entire database files, decrypts on read, native to SQL Server, Oracle, MySQL, PostgreSQL, (2) Column-level / cell-level encryption — encrypt specific sensitive columns (PII, payment data) with separate keys, (3) Application-level encryption — encrypt data in the application before storing, the database never sees plaintext (used for highest-sensitivity data), (4) Always Encrypted (SQL Server) and equivalent features — keep encryption keys outside the database engine. Cloud-managed options include AWS RDS with KMS, Azure SQL Database TDE with Customer-Managed Keys, Google Cloud SQL with CMEK. Top vendors: Thales CipherTrust, Vormetric (now Thales), Microsoft SQL Server Always Encrypted, Oracle Advanced Security, AWS KMS + RDS, Voltage SecureData (OpenText).

Two complementary states for data: (1) Encryption at rest — data stored on disks, databases, backups, removable media; protects against physical theft, lost laptops, compromised storage; standard implementation: AES-256 with key management via KMS or HSM, (2) Encryption in transit — data moving across networks (between client and server, between services, across cloud regions); protects against network eavesdropping and man-in-the-middle; standard implementation: TLS 1.3 with strong cipher suites, mutual TLS for service-to-service. Mature security programmes also implement (3) Encryption in use — data being processed in memory (homomorphic encryption, confidential computing with Intel SGX, AWS Nitro Enclaves, Azure Confidential VMs).

Three main approaches: (1) Cloud-managed KMS — AWS KMS, Azure Key Vault, Google Cloud KMS — easy to use, integrated, but the cloud provider technically has access to the keys, (2) Bring Your Own Key (BYOK) — generate keys outside cloud, import to KMS, the customer controls the key material, (3) Hold Your Own Key (HYOK) / external KMS — keys never leave customer-controlled hardware (HSM); cloud calls out to customer's HSM for every operation; required for highest-regulated workloads (national security, sovereign data). HSM vendors: Thales Luna, Entrust nShield, AWS CloudHSM, Azure Dedicated HSM, Google Cloud HSM. Best practices: separation of duties (one person never has all keys), automated key rotation, comprehensive audit logging, formal key lifecycle (generation, storage, distribution, rotation, revocation, destruction).

Current recommendations (NIST, ENISA, BSI): (1) Symmetric — AES-256-GCM for bulk encryption, ChaCha20-Poly1305 as alternative, (2) Asymmetric — RSA-3072+ or ECC curves (P-256, P-384, Curve25519, Ed25519); deprecate RSA-2048 by 2030, (3) Hashing — SHA-256, SHA-384, SHA-3; deprecate SHA-1 (broken) and MD5 (broken), (4) Passwords — Argon2id (preferred), bcrypt, scrypt; never SHA-only or MD5, (5) TLS — TLS 1.3 only, disable TLS 1.0/1.1/1.2, (6) Post-quantum — start migrating crypto-agile systems toward NIST PQC standards (CRYSTALS-Kyber for key exchange, CRYSTALS-Dilithium for signatures) to prepare for cryptographically relevant quantum computers expected in 2030-2040.

Encryption appears as a recommended or mandatory control across major regulations: GDPR — Article 32 lists encryption as an example of an appropriate technical measure; encrypted breaches often avoid notification obligations (Recital 83), HIPAA — encryption is an 'addressable' implementation specification (de facto required for cloud and remote work), PCI-DSS — Requirements 3 (storage) and 4 (transmission) mandate strong cryptography for cardholder data, SOX — controls for financial data integrity, NIS2 — Annex II security measures include cryptography, ISO 27001 — Annex A.10 and A.13 cover cryptography and communications security, DORA — explicit cryptographic controls in ICT risk management. Beyond compliance, encryption also limits liability after a breach and enables secure data sharing in M&A, audits and partnerships.