This workshop helps data protection officers, general counsel, and compliance leads assess and mitigate the legal liability from retaining data that will become vulnerable to quantum decryption.
Organisations retain encrypted data for years or decades under statutory and regulatory obligations. Financial records under MiFID II may be held for seven years. Medical records persist for decades. Privileged legal communications have no expiry. All of this data is currently protected by RSA and elliptic curve cryptography that a sufficiently capable quantum computer would break. The harvest-now-decrypt-later (HNDL) threat means adversaries can capture encrypted data today and decrypt it when quantum hardware matures. The legal question is whether organisations that know this risk exists, yet continue to retain data under vulnerable encryption, are meeting their duty of care.
GDPR Article 32 requires "appropriate technical and organisational measures" that account for the "state of the art." As NIST finalises post-quantum standards and national agencies issue migration guidance, the argument that quantum risk is speculative weakens. This workshop examines how courts and regulators are likely to interpret these obligations, identifies the sector-specific retention periods that create the longest quantum exposure windows, and provides a framework for documenting quantum-aware decisions that create a defensible compliance record.
Full Day Workshop structure with scheduled breaks. Content is configurable to your organisation's sector, data retention obligations, and regulatory jurisdiction.
| # | Session | Topics |
|---|---|---|
| 1 | The Harvest Now, Decrypt Later Liability Problem Why data encrypted today creates legal exposure tomorrow | |
| 2 | GDPR Article 32 and the Quantum Security Obligation When "appropriate technical measures" must account for future cryptanalytic capability |
|
| Break, after 50 min | ||
| 3 | Data Retention Obligations Versus Cryptographic Risk Sector-specific retention periods and their quantum exposure windows |
|
| 4 | Interactive Demonstration: Liability Risk Assessment Full-day format only |
|
| Break, after 60 min | ||
| 5 | Documenting Quantum Risk to Manage Liability Building a defensible record of quantum-aware decision-making |
|
| 6 | Mitigation Strategies and Regulatory Engagement Practical steps to reduce exposure before quantum-capable adversaries arrive |
|
| 7 | Q&A and Risk Mitigation Planning | |
Workshops are designed and delivered by QSECDEF in collaboration with sector specialists. All facilitators have direct experience in both quantum technologies and data protection law.
Workshop design and delivery
QSECDEF brings world-leading expertise in post-quantum cryptography, quantum computing strategy, and defence-grade security assessment. Our advisory membership spans 600+ organisations and 1,200+ professionals working at the intersection of quantum technologies and critical infrastructure security.
Domain expertise and regulatory validation
Data retention workshops are co-delivered with privacy lawyers and data protection specialists who have direct experience in GDPR enforcement, ICO investigations, and sector-specific retention compliance. This ensures workshop content reflects current regulatory interpretation and case law.
Sessions are configured around your organisation's sector, data retention obligations, and regulatory jurisdiction. Get in touch to discuss requirements and schedule a date.
Contact Us