In August 2024 NIST published the first post-quantum cryptography standards. In July 2026 the European Data Protection Board adopted new draft guidelines on anonymisation and on data scraping for generative AI. And the 20th STIC Conference of Spain’s National Cryptologic Centre, held in Madrid from 24 to 27 November 2026, carries an unambiguous theme: offensive AI and the quantum threat: towards a new cybersecurity.
The conclusion is uncomfortable for any data controller: much of the encryption protecting personal data today has an expiry date, and that date is closer than it looks.
What Q-Day is and why it already affects you
Q-Day is the moment a quantum computer becomes powerful enough to break, through Shor’s algorithm, the public-key systems that underpin digital communications: RSA, ECC and Diffie-Hellman. This is not a laboratory concern. Germany’s Federal Office for Information Security (BSI) has revised its quantum horizon downwards and set concrete migration deadlines, and much of the industry places Q-Day before 2030.
For a controller the exact date is secondary. What matters is the consequence: what would take decades to decrypt today will become solvable in a reasonable time, which makes a security measure considered sufficient today effectively reversible.
Harvest now, decrypt later: the attack already under way
The risk does not begin the day the quantum computer exists. The technique known as harvest now, decrypt later consists of intercepting and storing encrypted communications while waiting for the computing power needed to open them. The attacker does not need to break the encryption at capture time: storing it is enough.
That shifts the key question. It is no longer “is it encrypted?” but “for how many years does this data have to remain secret?”. A medical record, a court file, an HR report, a life insurance policy or the data of a schoolchild remain sensitive well beyond 2030.
If personal data must still be protected in 2035, the algorithm you encrypt it with in 2026 is already part of your risk analysis.
Article 32 GDPR is not a recommendation
Article 32 GDPR requires technical and organisational measures appropriate to the risk taking into account the state of the art, and expressly mentions encryption. That reference to the state of the art is the legal hinge of the whole matter: once published standards resistant to quantum attack exist, protecting long-lived data with RSA or ECC alone becomes increasingly hard to defend before a supervisory authority.
There is a second practical consequence, in Article 34: effective encryption is precisely what allows a controller to avoid communicating a breach to the affected individuals, because the data is unintelligible to the attacker. If that encryption stops being effective retroactively, a breach that did not have to be communicated yesterday may tomorrow become a breach with real impact on people’s rights.
The standards already exist: ML-KEM, ML-DSA and SLH-DSA
In August 2024 NIST finalised the first set of post-quantum cryptography (PQC) standards, designed to resist attacks by quantum computers:
- ML-KEM (FIPS 203) — key encapsulation, the replacement for current key exchange.
- ML-DSA (FIPS 204) — lattice-based digital signature.
- SLH-DSA (FIPS 205) — hash-based digital signature, as a conservative alternative.
The prevailing recommendation during the transition is hybrid architectures: combining a classical algorithm with a post-quantum one so that security does not depend on either being flawless. As for deadlines, the German BSI sets the most quoted reference: migration completed before 2030 for critical infrastructure and before 2032 for all other organisations.
And here lies the scheduling problem: a serious cryptographic migration is not measured in months. Before replacing anything you need to know what you are using, and very few organisations do.
Which of your data is at risk
The prioritisation criterion is not data volume but data lifespan. Any processing whose information must stay confidential for more than five years deserves immediate review:
- Medical records and health data.
- Court files and professional practice documentation.
- Employment files, payroll and HR data.
- Data of minors in education.
- Biometric data, which cannot be changed once leaked.
- Communications and files with public administrations.
- Long-retention backups, the most common blind spot.
The other front: offensive AI and the inference boundary
The quantum threat does not arrive alone. Generative AI has also changed the other end of the problem: you no longer need access to a piece of data to know it. A model can infer sensitive information — health status, political views, orientation — from apparently harmless data, and can re-identify people within datasets that were considered anonymised.
The EDPB addressed part of this ground on 7 July 2026, with two draft guidelines — anonymisation, and data scraping for generative AI — open to public consultation until 30 October 2026. They should be read as what they are, drafts, but the direction is clear: anonymisation stops being a label applied once and becomes a property that has to be sustained over time.
A realistic roadmap for 2026–2030
Phase 1 · Diagnosis (now). Cryptographic inventory: which algorithms, which key lengths, in which systems. Classification of processing activities by data lifespan. Assessment of exposure to harvest-now-decrypt-later. The Spanish DPA offers the free ValidaCripto RGPD tool, derived from the guidance published with ISMS Forum and APEP in May 2023, which runs in your own browser without sending data to the authority.
Phase 2 · Planning (2026–2027). A migration plan prioritised by criticality, updated data protection impact assessments (DPIAs) incorporating quantum risk, technical team training and, crucially, PQC clauses in contracts with suppliers and processors: your supply chain migrates at the pace you require, not the pace you hope for.
Phase 3 · Migration (2027–2030). Deployment of the NIST standards in hybrid architectures, starting with the systems processing long-lived data, and verification through an audit against Spain’s National Security Framework where applicable.
Three things you can do this week
- Ask what encryption you use. If nobody in your organisation can answer precisely, that is your first finding.
- Review your DPIAs. If none of them mentions the quantum threat, they are incomplete for long-lived processing.
- Require a plan from your suppliers. One written question today is worth more than an improvised clause three years from now.
Quantum-safe privacy is not a technical debate for specialists: it is a condition of legitimacy for any organisation that keeps personal data over the long term. At Eritia Privacidad we build this analysis into GDPR adaptation and into National Security Framework compliance, and we support controllers and processors through the cryptographic inventory and the migration plan. See our services or write to us for an initial assessment at no cost.
