Encryption is the process of encoding data so that only authorized parties with the correct key can read it. Data protection teams use encryption to protect files, disks, databases, and storage devices from unauthorized access, whether data is at rest on a device or in transit across a network.
What it does
Encryption tools convert readable data into ciphertext using a mathematical algorithm and a key. Only holders of the correct decryption key can reverse the process. Within the Data Protection category, this glossary entry covers data-at-rest (DAR) encryption specifically. Common forms include:
Full-disk encryption (FDE): encrypts every sector of a drive, including the OS partition.
File and folder encryption: encrypts individual files or directories, leaving other data untouched.
Database encryption: applies transparent or column-level encryption to database files or fields.
Self-encrypting drives (SEDs): hardware that encrypts data on the drive controller, independent of the host OS.
API-based encryption: developer libraries that encrypt fields inside applications before data reaches storage.
Some tools also support tokenization and data masking, which are related but distinct techniques covered in the Data Masking category.
Why teams buy it
Encryption is a baseline control in most compliance frameworks, including PCI DSS, HIPAA, CMMC, and ISO 27001. Teams buy DAR encryption tools to:
Protect laptops and removable drives from physical theft.
Meet regulatory requirements for protecting sensitive fields in databases.
Reduce breach notification obligations when encrypted data is exposed.
Secure storage on deployed or mobile hardware in high-risk environments.
What to look for
Algorithm strength: AES-256 is the current standard. Look for post-quantum readiness if your data has a long sensitivity life.
Key separation: the encryption tool should integrate with a dedicated Key Management system rather than storing keys alongside the data.
Performance impact: hardware-based encryption (SEDs, hardware security modules) adds less CPU overhead than software-only solutions.
Granularity: full-disk encryption protects a lost laptop; column-level or file-level encryption limits exposure inside a running system.
Centralized management: enterprise deployments need policy enforcement, audit logs, and remote key revocation from a single console.
OS and platform coverage: confirm support for your mix of Windows, macOS, Linux, and cloud storage targets.
Common confusions
Encryption vs. Key Management: Encryption tools perform the encode/decode operation. Key Management tools store, rotate, and audit the keys themselves. Most mature programs need both. This category covers encryption; the Key Management category covers the key lifecycle.
Encryption vs. Data Masking: Masking replaces sensitive values with realistic but fake substitutes, often for non-production use. Encryption preserves the original value and allows authorized recovery. See the Data Masking category for that distinction.
Encryption vs. Confidential Computing: Confidential Computing protects data while it is being processed in memory. Encryption protects data at rest or in transit, not during active computation.
Encryption tools
18 tools listed in Encryption. Paid listings are labeled.
Data Masking & Synthetic Data is a set of techniques that replace or generate sensitive data so that the result looks realistic but cannot be traced back to a real person or record.
Confidential Computing is a hardware-based security approach that protects data while it is actively being processed, not just when it is stored or in transit.
Data Security Posture Management (DSPM) is a category of security tools that discover, classify, and assess the risk of sensitive data across cloud and on-premises environments.
Frequently asked questions
What is the difference between full-disk encryption and file encryption?
Full-disk encryption protects every sector of a drive, so a stolen laptop exposes nothing without the key. File encryption targets individual files or folders, which lets you protect specific sensitive data while leaving other files accessible without a separate key.
Does encryption replace key management?
No. Encryption tools perform the encode and decode operations. Key management tools handle storing, rotating, auditing, and revoking the keys those operations depend on. Most security programs need both working together.
What encryption standard should I require from vendors?
AES-256 is the current baseline for data-at-rest encryption and is required by frameworks such as CMMC and FIPS 140-2. If your data must remain confidential for more than a decade, also ask vendors about post-quantum encryption readiness.
Does encrypting data at rest satisfy GDPR or HIPAA breach notification requirements?
Encryption can reduce or eliminate breach notification obligations under both GDPR and HIPAA when the exposed data is properly encrypted and the keys were not also compromised. Always confirm with legal counsel, as specific conditions apply.