Encryption safe harbor in state breach laws: why encrypted delivery matters

How does the encryption safe harbor work?#

The encryption safe harbor works by taking encrypted data out of what a state breach law treats as a reportable breach. Most state laws build their definitions around unencrypted personal information, or exclude data that was encrypted, redacted or otherwise made unreadable, so losing a properly encrypted drive generally does not trigger notice to individuals.

The safe harbor is a feature of each state's statute, not a single national rule. Wording, definitions and exceptions differ, and a company holding data about residents of many states can face several versions at once. Counsel assesses each incident against the laws that apply.

California adds a second reason to care. The CCPA gives consumers a private right of action for certain data breaches, framed around nonencrypted and nonredacted personal information, and that right applied to employee and B2B data even while those categories were otherwise exempt. Strong encryption of a delivery therefore bears on litigation exposure as well as on notice.

For an IT lead, the safe harbor is less a legal detail than a design requirement. Choices made before shipping, such as which tool encrypts the drive, where the passphrase lives and who can reach it, decide whether a later incident is a logged event or a notification exercise.

The key compromise exception#

The key compromise exception removes the safe harbor when the decryption key, password or credential was acquired along with the data, or was likely to have been. Encryption only protects data from people who cannot decrypt it; if the passphrase travels with the drive, the law generally treats the data as exposed.

The practical rule follows directly: the data and the means to read it should never sit in the same place or travel through the same channel.

• 1A passphrase written on a label, in the box or in a printed README.
• 2A password sent in the same email thread as the download link.
• 3Keys stored in the same bucket, folder or archive as the encrypted files.
• 4Shared credentials that unlock both the storage and the key.
• 5A laptop holding both the encrypted files and a signed-in password manager session.

What the statutes look for, and what to check#

State breach statutes look at whether the encryption actually made the data unreadable and whether the key stayed secure. Some refer to encryption in general terms, others to methods that meet accepted standards or leave data unusable, so the exact wording matters when an incident is assessed.

Why encrypted delivery matters for licensed datasets#

Encrypted delivery matters because a licensed dataset is most exposed while it moves: on a courier truck, behind a transfer link or in a staging bucket. Even a carefully prepared package may hold residual personal information that review missed, and the supplier is usually the party holding the data when it leaves.

Large deliveries make the point concrete. Multi-terabyte archives often ship on physical drives or are read from the supplier's own cloud storage rather than uploaded somewhere new. A lost drive with strong encryption and a separately held key is a very different event from a lost drive with a readable folder of support exports.

Staging copies deserve the same attention. Working folders, scratch databases and laptop exports used during preparation often hold less-redacted versions of the same records, so encrypt them, limit who can reach them and delete them once the buyer accepts the delivery.

Delivery practices that keep the safe harbor available#

These steps are ordinary security hygiene, but they also create the evidence counsel needs. When an incident happens, the first questions are how the data was encrypted and where the key was; a delivery record that answers both shortens the assessment.

• 1Encrypt the full drive or each archive with a current, widely accepted algorithm such as AES-256.
• 2Generate a unique passphrase or key for each delivery and never reuse one across buyers.
• 3Send the key through a different channel to a named person after the data arrives.
• 4Use encrypted transport for network transfers and encrypt staging copies at rest.
• 5Keep a chain of custody log: who prepared, sealed, shipped, received and decrypted.
• 6Record the encryption method and key handling in the delivery record.
• 7Wipe or retrieve drives, and revoke keys and access, once the buyer confirms receipt.

What the safe harbor does not cover#

The safe harbor does not cover obligations that come from somewhere other than the breach statute. A license agreement may require notice of any loss, encrypted or not, and confidentiality clauses in customer contracts can carry their own notice terms.

Cloud encryption at rest is a common blind spot. If storage decrypts transparently for anyone with valid credentials, a stolen access key exposes readable data, and the encryption did little for that incident. The safe harbor also says nothing about confidential business information such as pricing or customer lists, which breach laws do not reach but contracts and trade secret protection may.

Illustrative: a distributor ships an archive on encrypted drives#

Illustrative: a fictional industrial distributor licenses a prepared archive of order exceptions and returns from its Epicor ERP. The archive is too large for a simple transfer, so the IT lead ships it on encrypted drives, sends the passphrase separately to the buyer's named data lead once delivery is confirmed, and logs each handoff.

One package arrives with a torn seal. Because the delivery record shows the encryption method, the separate key exchange and the custody log, counsel can assess the event quickly. The company rotates the passphrase, has the buyer confirm checksums against the manifest and records the incident in the delivery file.

How SourceX approaches encrypted delivery#

SourceX treats encryption and key handling as part of the Delivery step in the SourceX five-step transaction. Large datasets stay in the supplier's own storage or ship on encrypted drives, and SourceX never hosts multi-terabyte datasets.

The delivery method, the handover and the release authorization are recorded in the SourceX Evidence Packet. The Data and Trust Alliance's Data Provenance Standards list encryption among the privacy-enhancing tools a dataset record can declare, which supports writing the method down rather than assuming it.