Domain · Data security

Your sensitive data: located, protected, restorable.

We inventory and classify your sensitive data, align encryption and access with that classification, check that your backups would survive ransomware and that you know how to restore them, and get rid of the data you no longer have a reason to keep.

Describe your need All domains

Situations

You are in the right place if…

Nobody can say where every copy of your customer file or your HR data lives.
Production exports travel by email, on file shares or into test environments.
Your backups exist, but nobody has restored a whole system in a long time.
A customer, an insurer or an auditor asks for your encryption and data retention policy.
Laptops and removable media hold unencrypted sensitive data.

Our conviction

You can only protect well the data you know the whereabouts of.

Encryption, access control, backup: every measure applies to a scope. Without an inventory or a classification, what is easy gets encrypted, what is visible gets backed up, and the copies that leak are forgotten.

So we start from the data itself: where it lives, who accesses it, how long it must exist. Protection follows that classification, and a backup only counts once its restore has been proven.

Our approach

From the data map to a proven restore.

A simple classification, owned by the business, that decides the protection.

01LocateSensitive and personal data, the applications, databases, file shares, test environments, laptops and cloud services that hold or copy it.
You getA map of your data and its copies
02ClassifySensitivity levels defined with the business, an owner for each data set, handling and sharing rules per level.
You getA classification scheme and its rules
03ProtectEncryption at rest and in transit according to the classification, encrypted laptops and removable media, restricted access, controlled external sharing.
You getAn encryption and data protection policy
04Back up and eraseBackups with one kept offline, regular restore tests, retention periods, purges and secure deletion when equipment reaches its end of life.
You getA tested backup plan and retention periods that are applied

What the texts say

What the texts expect of data security.

The texts ask for protection proportionate to how sensitive the data is, encryption where it is warranted and the ability to restore data after an incident.

GDPRRGPD art. 5(1), point (f) · RGPD art. 5(1), point (e) · RGPD art. 32(1) · RGPD art. 32(1), point (a) · RGPD art. 32(1), point (c)
The GDPR requires personal data to be processed in a manner that ensures its security and kept no longer than necessary; controller and processor implement measures appropriate to the risk, including, as appropriate, pseudonymisation and encryption, and the ability to restore the availability of the data in a timely manner after an incident.1 2 3 4 5
DORADORA art. 8(1) · DORA art. 9(2) · DORA art. 12(1), point (a) · DORA art. 12(2)
DORA requires financial entities to identify, classify and document their information assets, to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit, and to set backup policies based on the criticality or confidentiality level of the data, with periodic tests of backups and restores.6 7 8 9
DORA · RTSRTS 2024/1774 art. 6(1) · RTS 2024/1774 art. 6(2) · RTS 2024/1774 art. 6(2), point (a)
Its RTS requires a policy on encryption and cryptographic controls, designed on the basis of an approved data classification and ICT risk assessment, that covers in particular the encryption of data at rest and in transit.10 11 12
NIS 2 · ReCyFNIS 2 art. 21(1) · NIS 2 art. 21(2), point (h) · NIS 2 art. 21(2), point (c) · ReCyF v2.5, objectif 13
The directive asks Member States to require policies and procedures of entities regarding cryptography and, where appropriate, encryption, as well as backup management; ReCyF (working version) sets them the objective of operational backup and restore mechanisms, tested at least once a year.13 14 15 16
CNIL guideGuide CNIL sécurité, fiche 7, F07-PE-04 · Guide CNIL sécurité, fiche 22, F22-PE-07 · Guide CNIL sécurité, fiche 17, F17-PE-01 · Guide CNIL sécurité, fiche 17, F17-PE-03 · Guide CNIL sécurité, fiche 17, F17-PE-06 · Guide CNIL sécurité, fiche 15, F15-PE-06
The CNIL recommends encrypting laptops and removable media, encrypting data at rest and in transit in the cloud, backing up frequently with at least one backup kept offline, regularly testing restores, and securely deleting data before equipment is scrapped or sent for repair.17 18 19 20 21 22

The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.

Our engagement

The same topic, at three levels of commitment.

You choose the level; the scope and deliverables are set by contract.

Level 01

Monitor

We follow the protection of your sensitive data at agreed intervals.

Deliverables

A map of sensitive data kept up to date
Follow-up of restore tests and their results
Alerts on encryption and retention gaps

Level 02

Advise

We design the classification, the encryption policy and the backup plan, and recommend the measures, which you decide on.

Deliverables

Data map and classification scheme
Encryption, sharing and retention policy
Backup plan and restore test protocol

Level 03

Drive

We run the programme with your IT department, your business teams and your DPO, without making the changes in your systems ourselves.

Deliverables

Steering of encryption and offline backups
Restore tests run and gaps followed up
Evidence ready for the auditor, the authority or the customer

Accelerators

What we bring from day one.

Classification scheme

Sensitivity levels, examples per business line and the handling rules that go with them: a scheme to adapt to your organisation.

Restore test protocol

What is restored, how fast, and what is checked afterwards: a protocol to prove your backups, not just count them.

Your tracking web app

Sensitive data, protection measures, restore tests and gaps in a tool shared with your teams.

Frequently asked questions

Before we start.

Should we encrypt everything?

No. Encryption is decided from the data classification and the risks: that is how DORA’s RTS asks for the encryption policy to be designed. Sensitive data, laptops, backups and flows leaving your network come first.11

Would our backups survive ransomware?

Only if at least one of them is kept offline, out of reach of an attacker who controls your network, and if you have checked that you know how to restore it. We test both.20 21

Is our cloud provider’s encryption enough?

It protects against a disk stolen at the provider, not against a compromised account, nor against the provider itself when it holds the keys. Who manages the keys, and who can read the data in clear, are the real questions.

Do you work on our systems?

No. We design, steer and verify; your teams or your integrator deploy encryption, backups and purges. We can help you find the right integrator, whom you engage.

Start with your three most sensitive data sets.

Tell us which they are, where they live and how they are backed up. We come back to you with a scoping proposal.

Describe your need

Sources

The excerpts quoted.

Exact text, in its original language, from the frameworks extracted from the official text.

Show the 22 excerpts quoted

1RGPD art. 5(1), point (f)32016R0679-a5-p1-6
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Version
CELEX 32016R0679 — ELI reg/2016/679
Official text
2RGPD art. 5(1), point (e)32016R0679-a5-p1-5
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Version
CELEX 32016R0679 — ELI reg/2016/679
Official text
3RGPD art. 32(1)32016R0679-a32-p1
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Version
CELEX 32016R0679 — ELI reg/2016/679
Official text
4RGPD art. 32(1), point (a)32016R0679-a32-p1-1
the pseudonymisation and encryption of personal data;
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Version
CELEX 32016R0679 — ELI reg/2016/679
Official text
5RGPD art. 32(1), point (c)32016R0679-a32-p1-3
the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Version
CELEX 32016R0679 — ELI reg/2016/679
Official text
6DORA art. 8(1)32022R2554-a8-p1
As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
Version
CELEX 32022R2554 — ELI reg/2022/2554
Official text
7DORA art. 9(2)32022R2554-a9-p2
Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
Version
CELEX 32022R2554 — ELI reg/2022/2554
Official text
8DORA art. 12(1), point (a)32022R2554-a12-p1-1
backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data;
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
Version
CELEX 32022R2554 — ELI reg/2022/2554
Official text
9DORA art. 12(2)32022R2554-a12-p2
Financial entities shall set up backup systems that can be activated in accordance with the backup policies and procedures, as well as restoration and recovery procedures and methods. The activation of backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. Testing of the backup procedures and restoration and recovery procedures and methods shall be undertaken periodically.
Normative force
directly applicable EU law (regulation, level 1)
Source
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
Version
CELEX 32022R2554 — ELI reg/2022/2554
Official text
10RTS 2024/1774 art. 6(1)32024R1774-a6-p1
As part of their ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement a policy on encryption and cryptographic controls.
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
11RTS 2024/1774 art. 6(2)32024R1774-a6-p2
Financial entities shall design the policy on encryption and cryptographic controls referred to in paragraph 1 on the basis of the results of an approved data classification and ICT risk assessment. That policy shall contain rules for all of the following:
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
12RTS 2024/1774 art. 6(2), point (a)32024R1774-a6-p2-1
the encryption of data at rest and in transit;
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
13NIS 2 art. 21(1)32022L2555-a21-p1
Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services. Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in the first subparagraph shall ensure a level of security of network and information systems appropriate to the risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.
Normative force
EU law to be transposed (directive): not directly applicable, requires national transposition
Source
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
Version
CELEX 32022L2555 — ELI dir/2022/2555
Official text
14NIS 2 art. 21(2), point (h)32022L2555-a21-p2-8
policies and procedures regarding the use of cryptography and, where appropriate, encryption;
Normative force
EU law to be transposed (directive): not directly applicable, requires national transposition
Source
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
Version
CELEX 32022L2555 — ELI dir/2022/2555
Official text
15NIS 2 art. 21(2), point (c)32022L2555-a21-p2-3
business continuity, such as backup management and disaster recovery, and crisis management;
Normative force
EU law to be transposed (directive): not directly applicable, requires national transposition
Source
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
Version
CELEX 32022L2555 — ELI dir/2022/2555
Official text
16ReCyF v2.5, objectif 13recyf:obj-13
Les entités [importantes ou essentielles] mettent en œuvre des mécanismes de sauvegarde et de restauration opérationnels et les testent au minimum une fois par an. Les entités [essentielles] définissent et maintiennent à jour des plans de continuité et de reprise d’activité adaptés aux besoins de leurs activités et services.
Normative force
obligation (decree, resilience bill)
Source
ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
Version
2.5 du 17/03/2026 (version de travail)
Status
Working version: not binding until the transposition is enacted
Official text
17Guide CNIL sécurité, fiche 7, F07-PE-04F07-PE-04
Prévoir des moyens de chiffrement des postes nomades et supports de stockage amovibles (ex. : ordinateur portable, clé USB, disque dur externe, CD-R, DVD-RW) tels que : le chiffrement du disque dur (de nombreux systèmes d’exploitation intègrent une telle fonctionnalité) ; le chiffrement fichier par fichier ; la création de conteneurs (dossier susceptible de contenir plusieurs fichiers) chiffrés.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
18Guide CNIL sécurité, fiche 22, F22-PE-07F22-PE-07
Appliquer les précautions élémentaires du présent guide aux traitements dans le cloud. En particulier : chiffrer les données au repos et en transit et avoir une gestion des clés cryptographiques appropriée (voir la fiche n°21 - Chiffrement, hachage, signature). Il est à noter que l’utilisation des services de gestion de clefs proposés par le fournisseur de service implique que ce dernier a la capacité d’accéder aux données ; attribuer méticuleusement les accès et autorisations aux seules personnes habilitées à accéder aux ressources (données et applications) dans le cloud et appliquer le principe de moindre privilège (voir la fiche n°5 - Gérer les habilitations) ; authentifier les utilisateurs pour les accès aux services dans le cloud (voir la fiche n°4 - Authentifier les utilisateurs) et n’accorder que les habilitations nécessaires (voir la fiche n°5 - Gérer les habilitations) ; configurer les permissions liées aux ressources dans le cloud ; réaliser des sauvegardes (voir la fiche n°17 - Sauvegarder) et vérifier que le fournisseur dispose bien de lieux de sauvegarde géographiquement éloignés des centres de données.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
19Guide CNIL sécurité, fiche 17, F17-PE-01F17-PE-01
Effectuer des sauvegardes fréquentes des données, que celles-ci soient sous forme papier ou électronique. Il peut être opportun de prévoir des sauvegardes incrémentales quotidiennes et des sauvegardes complètes à intervalles réguliers.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
20Guide CNIL sécurité, fiche 17, F17-PE-03F17-PE-03
Isoler au moins une sauvegarde hors ligne, déconnectée du réseau de l’entreprise.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
21Guide CNIL sécurité, fiche 17, F17-PE-06F17-PE-06
Tester régulièrement l’intégrité des sauvegardes et la capacité de les restaurer.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
22Guide CNIL sécurité, fiche 15, F15-PE-06F15-PE-06
Supprimer de façon sécurisée les données des matériels avant leur mise au rebut, leur envoi en réparation chez un tiers ou en fin du contrat de location.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text