Encryption should be used to protect all personal information stored by a company or sent to third parties.

• A. True
• B. False
• C. Not necessary
• D. Optional

Answer: (A)

Encryption protects personal information by keeping it confidential whether it's stored or being sent to others. When data are encrypted, an unauthorized reader cannot understand them without the decryption keys, so the impact of a breach or interception is greatly reduced. This is especially important for data shared with third parties, since encryption in transit and at rest helps prevent exposure by vendors, partners, or service providers. Implementing encryption requires strong algorithms and solid key management—keys should be protected separately, rotated regularly, and access tightly controlled. Because safeguarding personal information is a fundamental security and privacy obligation, encryption should be applied to all personal data stored or transmitted, with additional controls to manage remaining risks.