Post-quantum migration under the GDPR: Risk proportionality and timing

Cryptographically relevant quantum computers would undermine widely deployed public-key mechanisms, while harvest now, decrypt later attacks separate the acquisition of encrypted material from its eventual exploitation. For personal data requiring long-term confidentiality, this raises a present question about appropriate protection under Articles 25 and 32 of the General Data Protection Regulation. Standardisation and deployment of post-quantum cryptography strengthen the practical basis for protective action. Its timing and scope depend on credible acquisition pathways, exposed cryptographic dependencies, the remaining confidentiality horizon, consequences for individuals, and the effectiveness and costs of available measures. A genomic biobank example applies this assessment to transmission, storage and key management, comparing targeted hybrid deployment with immediate security improvements and replacement of legacy systems. Preparation and selective deployment may become necessary before comprehensive migration is proportionate, while deferral requires continuing review. Court of Justice judgments inform the assessment of appropriateness, accountability and the separate conditions for compensation. NIS2, DORA and the Cyber Resilience Act support the transition through governance and product requirements within their respective scopes. A possible infringement rests on the inadequacy of the controller’s security measures in their contemporary circumstances, assessed through the exposure, available protection and reasons for the chosen timetable.