Category: Cryptography and Encryption

Confidentiality

Also known as: Data confidentiality

Simply put

Confidentiality means protecting information so that it is only accessible to people, systems, or processes that are authorized to see it. It is about preventing unauthorized access, disclosure, or theft of data, whether that data is stored, being processed, or in transit. In practical terms, it is the safeguard that keeps private or sensitive information from being exposed to those who should not have it.

Formal definition

Confidentiality is the assurance that information is not disclosed to unauthorized persons, processes, or devices, spanning data in storage, during processing, and (per common security framing) in transit. As one of the core information security objectives, it is achieved through access controls, authentication, and related safeguards that protect data against unintentional, unlawful, or unauthorized access, disclosure, or theft. Confidentiality is a security property and should not be equated with the broader set of data governance obligations; it addresses whether data is exposed to unauthorized parties rather than data ownership, quality, lineage, or lawful basis for processing. This entry defines the concept only and does not cover specific technical control implementations, applicable regulatory disclosure duties, breach notification requirements, or how confidentiality controls interact with the classification of data as personal or special category data.

Why it matters

Confidentiality is one of the foundational objectives of information security, and its failure is what most people mean when they refer to a data breach in everyday terms. When information is disclosed to parties who are not authorized to see it, the harm can extend from reputational damage and loss of trust to legal exposure and direct harm to the individuals whose information was exposed. In sectors that handle particularly sensitive information, such as healthcare, confidentiality has long been understood as a core professional obligation, framed as the principle of keeping information given by or about an individual secure and secret from others.

It is important to be precise about what confidentiality does and does not address. Confidentiality is a security property concerned with whether data is exposed to unauthorized persons, processes, or devices. It is not the same as the broader set of data governance obligations, which cover matters such as data ownership, quality, lineage, and the lawful basis for processing. A system can enforce strong confidentiality controls and still fall short on governance, and vice versa. Treating the two as interchangeable is a common mistake that leads organizations to overstate their compliance posture.

Because confidentiality applies to data in storage, during processing, and, under common security framing, in transit, it must be considered across the full lifecycle of information rather than at a single point. This entry defines the concept only; it does not address specific regulatory disclosure duties, breach notification requirements, or how confidentiality controls relate to whether data is classified as personal or special category data. Those determinations depend on jurisdiction and context and should be assessed separately.

Who it's relevant to

Information security and privacy engineers

Those responsible for designing and operating systems that hold sensitive information need to treat confidentiality as one of the core security objectives, implementing access controls and authentication to limit exposure across data at rest, in processing, and in transit. They should also recognize that confidentiality is distinct from data governance concerns and does not by itself resolve whether data is personal or special category data.

Compliance officers and data protection officers

These roles rely on a clear separation between confidentiality as a security property and the broader governance and lawful-basis obligations they oversee. Understanding that strong confidentiality controls do not by themselves demonstrate compliance helps them avoid overstating an organization's posture and directs attention to the additional obligations that this entry does not cover, such as regulatory disclosure and breach notification requirements.

Professionals in sensitive sectors such as healthcare

In settings where confidentiality has a long-standing professional grounding, it is understood as protecting personal information and keeping information given by or about an individual secure and secret from others. Practitioners in these fields treat confidentiality as a core duty, though the specific legal and regulatory requirements attached to it fall outside the scope of this conceptual definition.

Inside Confidentiality

Confidentiality as a security property

Confidentiality is one of the three core objectives of information security, alongside integrity and availability, and refers to ensuring that data is accessible only to those authorized to access it. It sits within the information security domain rather than the data governance domain, though the two overlap where governance policy defines who is authorized.

Access control

The set of controls that determine and enforce who may access which data and under what conditions, including authentication, authorization, and the principle of least privilege. These controls are a primary mechanism for maintaining confidentiality.

Encryption and related protective measures

Technical measures such as encryption, and in some designs tokenization, that protect data from unauthorized disclosure in transit and at rest. These support confidentiality but do not, by themselves, remove data from the scope of data protection law; encrypted or tokenized personal data generally remains personal data.

Relationship to data protection obligations

Confidentiality contributes to, but is not the same as, compliance with data protection regimes such as the EU GDPR, UK GDPR, CCPA and CPRA, or HIPAA. Confidentiality addresses one dimension of protecting data; data protection law additionally addresses lawful basis, purpose limitation, individual rights, and other obligations that confidentiality controls do not satisfy on their own.

Confidentiality obligations by role

Confidentiality duties typically attach to parties handling data, including data controllers and data processors, though the specific allocation of responsibility depends on the applicable instrument and contractual arrangements. Under governance frameworks, meeting a confidentiality obligation generally requires demonstrable evidence of the controls in place, not merely a stated commitment.

Common questions

Answers to the questions practitioners most commonly ask about Confidentiality.

Does keeping data confidential mean it is no longer personal data?

No. Confidentiality is a security property that limits access to authorized parties; it does not change the legal status of the data. Applying confidentiality controls such as access restrictions, encryption, or tokenization does not make data non-personal. If the data still relates to an identifiable individual, or can be re-identified by the party holding the keys or mapping, it remains personal data and stays within scope of applicable data protection regimes. Only genuine, irreversible anonymization removes data from that scope, and that is a separate concept from confidentiality.

Is confidentiality the same thing as data protection or privacy compliance?

No. Confidentiality is one of the three classic information security objectives, alongside integrity and availability, and it concerns preventing unauthorized access or disclosure. Data protection and privacy are broader, covering matters such as lawful basis for processing, data subject rights, purpose limitation, and accountability. Confidentiality supports data protection but does not by itself satisfy it. This entry addresses confidentiality as a security concept and does not cover lawful bases, retention rules, cross-border transfer mechanics, or enforcement penalties.

How is confidentiality typically enforced at a technical level?

Confidentiality is generally enforced through a combination of access controls, authentication and authorization mechanisms, least-privilege and need-to-know principles, encryption of data in transit and at rest, and network segmentation. The appropriate mix depends on the sensitivity of the data and the assessed risk. No single control guarantees confidentiality; effectiveness depends on correct implementation, configuration, and ongoing management. This entry does not prescribe specific technical standards for any given regime.

How should confidentiality obligations be allocated between a controller and a processor?

In most data protection regimes, the controller determines the purposes and means of processing and bears primary accountability, while a processor acts on the controller's documented instructions. Confidentiality obligations are typically flowed down through a written processing agreement that requires the processor to implement appropriate security measures and to ensure that persons authorized to process the data are bound by confidentiality. The controller generally remains responsible for verifying that these safeguards exist; stating an obligation is not sufficient without demonstrable evidence.

How can an organization demonstrate that confidentiality controls are actually in place?

Under accountability-oriented governance frameworks, confidentiality must be demonstrable rather than merely asserted. Evidence typically includes documented access control policies, records of access reviews, encryption configuration and key management records, logs of authorization changes, results of testing or audits, and contractual confidentiality commitments. The specific evidence expected varies by framework and context. This entry does not enumerate the documentation required by any particular standard or regulator.

Where does confidentiality fit within governance versus security responsibilities?

Confidentiality sits primarily within information security, which addresses the controls that protect data from unauthorized access. Governance functions such as data ownership, stewardship, classification, and policy setting determine which data requires which level of confidentiality and who is accountable for it. The two overlap where classification decisions drive control selection, but they remain distinct: governance defines the policy and accountability, while security implements and operates the protective controls.

Common misconceptions

Encrypting or tokenizing data makes it non-personal and takes it outside data protection law.

Encryption and tokenization are confidentiality-supporting measures, but they are generally reversible for the party holding the keys or mapping. In most jurisdictions such data continues to be treated as personal data and remains within the scope of applicable data protection obligations.

Confidentiality is the same thing as privacy or data protection compliance.

Confidentiality is one security property concerned with preventing unauthorized disclosure. Data protection compliance is broader and, depending on the regime, also involves lawful basis for processing, purpose limitation, data subject rights, and accountability. Achieving confidentiality does not by itself demonstrate compliance.

Confidentiality is purely a governance concern about who owns the data.

Confidentiality belongs primarily to information security, addressing enforcement of authorized access. Data governance may define who is authorized and set policy, but the two disciplines are distinct and should not be collapsed; they overlap at the point where governance policy informs access decisions.

Best practices

Apply the principle of least privilege and enforce access control so that data is reachable only by authorized parties, and record the authorization decisions as demonstrable evidence.

Use encryption for data in transit and at rest as a confidentiality measure, while continuing to treat encrypted or tokenized personal data as personal data for the purposes of applicable data protection obligations.

Distinguish confidentiality controls from broader data protection compliance, and confirm that lawful basis, purpose limitation, and individual rights are addressed separately rather than assumed to follow from confidentiality alone.

Clearly allocate confidentiality responsibilities between data controllers and data processors through contractual arrangements consistent with the applicable instrument.

Keep governance policy and security enforcement aligned by ensuring that who is authorized (a governance question) is consistently reflected in the technical access controls that enforce confidentiality.

Maintain documented, verifiable evidence of confidentiality controls to support accountability, since stated intent is generally insufficient under governance frameworks.