I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql).

Now I have read somewhere, that it is a good idea to have your database designed in such a way, hat even if someone gets hold of it, they can't get at sensitive info (password, etc.).

However, as far as I know, the GDPR classifies email addresses as sensitive/personal info, so that should be protected as well. Since I will be sending confirmation and notification emails, a hash will not be good, and I have no idea where I should encrypt the email addresses: If at a php level, I will either have a hard-coded key (BAD) or a configuration file with a key in it (more problems). I have been told that I can do it at a database level but if I'm protecting them against the database being stolen, wouldn't that also steal the encryption key?

What is the proper way to keep emails hidden even if the database is compromised?


You do not need to encrypt the email field in your database to comply with GDPR. It is not sensitive info, but just personal.

Passwords and emails are simply not in the same classification of data.

GDPR is not concerned with protecting the data if someone gets their hands on the database. It is concerned with preventing someone getting access to the data who should not be and making sure that those who are authorised should have access at all.

Special category data needs extra protection, including encryption, but GDPR is concerned with the normal operation of the system.

Protect the data as you would all other personal data in the system.

If your database is compromised, you will get in trouble with the ICO because you got compromised and all the other personal data was exposed. Emails will not be a special concern.

  • Let us assume that at the moment, email addresses are the only personal info in the database. – Mark Gardner Nov 19 '18 at 15:04
  • Well, technically, you would be wrong (identifiers and IP addresses count along with other bits), but if we take your suggestion for argument, then you simply hold the encryption keys on a separate key server. – schroeder Nov 19 '18 at 15:06
  • If this is your question, then this is actually off-topic here. This is a programming design question with a security component. – schroeder Nov 19 '18 at 15:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.