Data encryption is the process of turning readable information into unreadable ciphertext that only someone holding the right key can turn back. If a laptop is stolen, a database is breached, or an email is intercepted, encrypted data is worthless to whoever holds it — without the key, it is noise. For a small business in 2026 encryption is not a specialist topic: it is already running everywhere, and the job is making sure it is switched on in the right places. This guide explains what encryption actually does, where a business needs it, and where it does not help.
TL;DR
- Data encryption turns readable data into unreadable ciphertext; only the right key restores it.
- The two kinds that matter: encryption at rest (on the device or disk) and in transit (travelling across networks).
- A stolen encrypted laptop is a lost asset; a stolen unencrypted one is a notifiable data breach.
- Encryption does not stop phishing or malware — it protects data after something else has already failed.
- Turning on disk encryption and full-disk device policies is one of the cheapest, fastest security wins available.
What data encryption means in plain terms
Encryption uses a mathematical algorithm and a key — a secret value — to scramble data. Anyone holding the key can reverse the process; anyone without it sees only noise. The strength of modern encryption comes from the sheer number of possible keys: a standard 256-bit key has more combinations than there are atoms in a reasonable share of the universe, which is why brute-forcing modern encryption is not a practical attack.
Two contexts matter for a business:
- Encryption at rest protects data sitting on a device or server — the hard drive of a laptop, the disk of a file server, the database holding customer records.
- Encryption in transit protects data moving between places — email travelling between mail servers, a document uploaded to cloud storage, a payment sent to a bank.
Both are needed: a document can be perfectly protected at rest and exposed the moment it travels.
Where encryption already is — and where businesses assume wrong
Most small businesses already run more encryption than they realise:
| Where | Typical state | What to verify |
|---|---|---|
| Websites | HTTPS is near-universal | Padlock in the browser; any site handling logins or payments without it is a red flag |
| Cloud tools (Microsoft 365, Google Workspace, Xero) | Encrypted by default | Which staff can access what — encryption does not fix permissions |
| Laptops and phones | Often off by default | Disk encryption is the biggest silent gap — turn it on fleet-wide |
| In transit, usually yes | End-to-end encrypted email for sensitive documents usually needs deliberate setup | |
| Backups | Varies wildly | An unencrypted backup drive is a copy of the breach, stored in a drawer |
The pattern: cloud services do encryption for you, while the devices and backups your business owns often do not have it turned on. That is where a small business actually makes gains.
What encryption protects against — and what it does not
| Scenario | Does encryption help? | Why |
|---|---|---|
| Laptop stolen from a car | Yes — if disk encryption is on | The data is unreadable without the login credentials |
| Database breached | Yes — if the database or columns are encrypted | Stolen data stays unreadable |
| Backup drive lost | Yes — if backups are encrypted | The copy is unusable without the key |
| Email intercepted | Yes — TLS in transit | Standard mail transport is encrypted; content is protected between servers |
| Phishing email | No | The user hands the password over willingly |
| Malware on an unencrypted device | No | Encryption protects data at rest, not against code running with the user's privileges |
| Ransomware | No | Ransomware encrypts your files itself — encryption is the attack, not the defence |
The pattern in the right-hand column matters as much as the left: encryption is a backstop that limits damage after something else has failed. It never replaces MFA, patching or staff training — it bounds the cost of their failure.
The encryption basics every small business should enforce
- Full-disk encryption on every laptop and desktop. BitLocker on Windows Pro and FileVault on Mac are built in, free, and take minutes to enable. This single step turns a stolen laptop from a potential notifiable data breach into a lost asset.
- Device encryption on every phone. Modern iPhones and Android phones encrypt by default; the gap is a staff phone with an old OS or no screen lock.
- Encrypted backups. Cloud backup services encrypt by default; check any local or offsite backup drive.
- HTTPS everywhere on anything customer-facing. If a site handles logins or payments, encryption in transit is not optional — it is the baseline customers expect.
- Key and password discipline. Encryption is only as strong as the key, and the key is only as strong as the password protecting it. A BitLocker recovery key emailed to a personal Gmail account undoes the whole exercise.
- Document where encryption is and is not in place. Insurers, Essential 8 and SMB1001 all ask. A one-page note — what is encrypted, how, and where keys are stored — turns encryption into compliance evidence.
The stolen laptop scenario, in numbers
The reason disk encryption is the highest-value step on this list: an unencrypted lost or stolen device containing personal information can trigger the Notifiable Data Breaches scheme in Australia, with its obligations to notify the OAIC and affected individuals — and remediation costs well beyond the hardware. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 recorded more than 84,700 cybercrime reports in 2024-25, averaging one every six minutes, with small business self-reporting an average cost of $56,600 per incident. A $0 encrypted laptop is a lost asset; the same laptop without encryption is a breach process, a legal question, and a customer trust problem.
Encryption bounds the damage of physical loss, but it cannot stop the credential-level attacks that start most incidents. Cyber Aware's security awareness training runs monthly and targets the phishing and fake-login-page attacks that encryption cannot help with, while human risk reporting tracks whether the reporting reflex is actually landing. For a checklist of which controls — encryption, MFA, patching, training — are covered and which are missing, a cyber security gap assessment gives the ranked answer.
FAQ
What is data encryption in simple terms? Turning readable data into unreadable ciphertext that only the holder of the right key can restore. It protects data on lost devices, in breached databases and in intercepted traffic.
What is the difference between encryption at rest and in transit? At rest protects data sitting on a device or disk; in transit protects it while it moves between systems. A business needs both — a document protected at rest is exposed the moment it travels unencrypted.
Does encryption stop hackers? It stops them reading the data they take, but not getting in. Phishing, malware and weak passwords bypass encryption entirely — it limits damage after something else has failed.
How do I know if my laptop is encrypted? On Windows Pro, BitLocker shows in Control Panel under BitLocker Drive Encryption. On Mac, FileVault shows in System Settings under Privacy & Security. Both are built in and free.
Do we need to buy encryption software? Usually not. Disk encryption, HTTPS, and cloud service encryption are included with the tools you already run. The typical gap is enabling them, not buying them.
What is the weakest link in encryption? The key. If recovery keys are stored badly — emailed, on the encrypted device itself, in a shared password document — the encryption is decorative.
One last thing
Check three things this week: whether disk encryption is on for every laptop (BitLocker or FileVault), whether your backup drive is encrypted, and where the recovery keys are stored. All three checks take minutes, all three are free, and together they close the most common silent gap in small business security.