Reasonable Security Safeguards in a Post-Quantum World

**Utkarsh Rai

Imagine a hypothetical scenario where cybercriminals obtain unauthorized access to personal, commercial or privileged data such as financial records, legal communications and health records. Now in this scenario there is a distinct possibility of such access resulting in severe financial and personal harm to the victims, however this is normally not the case. Encryption that is common to most of the modern digital infrastructure prevents such malicious actors from meaningfully accessing this stolen data and using it for nefarious purposes. Today, advances in quantum-computing technology have severely threatened the reliability of a lot of these encryptions commonly used to protect the victims of such crimes. This article aims to shed some light on the evolving nature of cryptography in light of such technological advancements and the implications it might have within the legal data privacy framework of India.

Understanding Modern Encryptions

Encryption works by transforming readable data (“plaintext”) into an unreadable scramble (“ciphertext”) using a mathematical key. Encryption must be imagined as a lock. The data is the contents of a safe, and the key is the only thing that opens it. Stealing the safe without the key leaves you with nothing useful. Only someone with the corresponding cryptographic key can reverse the encryption process and read the original information. Modern encryption achieves this in two ways: Symmetric and Asymmetric encryption. 

Symmetric encryption uses the same cryptographic key to lock and unlock data. It is commonly used in the protection of data at rest. Asymmetric encryption, on the other hand, uses a pair of mathematically linked keys: a public key that anyone can use to encrypt data, and a private key held only by the intended recipient to decrypt it. These types are used in nearly every secure interaction online, ranging from logging into a bank account to signing a legal document digitally.

Any data protected using modern encryption algorithms is practically unassailable, provided the cryptographic key itself remains secure. These algorithms are so trusted because the mathematical problems working as the foundation for them are so computationally difficult that brute-forcing them is effectively impossible for any computer that exists today.

For reference, breaking the standard 2048-Bit RSA encryption or Elliptic Curve Cryptography (“ECC”), which are used in accessing UPI transactions, bank servers, digital signatures, network security, cryptocurrencies and storage of other sensitive data, would take millions or billions of years on a classical supercomputer today.

The Approaching Threat of Quantum Computing

The issue being discussed in this article, however, is not the present status quo but rather the future that follows with emerging technology that threatens modern asymmetric encryption. 

Shor’s algorithm, a mathematical algorithm designed by Dr. Peter Shor in 1994, utilises quantum computers to factorize the large numbers that underpin RSA encryption exponentially faster than any classical computer. On a sufficiently advanced fault-tolerant quantum computer, meaning one stable enough to execute complex operations without cascading errors, Shor’s Algorithm could reduce the time needed to break 2048-bit RSA encryption from billions of years to a matter of hours or days. 

This growing capability to break these encryptions using quantum computing creates a specific legal risk. A 2023 report by IBM suggests that 82% of all data breaches involved cloud-stored data, which predominantly by nature is encrypted. 

Harvest Now, Decrypt Later

Presently, such encrypted data will not give anything of value to the attacker. However, an adversary may instead harvest encrypted data now, store it, and decrypt it once quantum capability matures. This practice is known as Harvest Now, Decrypt Later (or “HNDL”) and has attracted significant international concern. What makes the threat particularly difficult to deal with is its temporal dimension. The harvesting of encrypted data may already be underway at scale, meaning that by the time quantum decryption becomes feasible, the prevention window will have long closed.

The Current Legal Position on the HNDL Threat in India

This threat of the breaking of such encryption algorithms creates an immediate legal question under the Digital Personal Data Protection Act, 2023 (“DPDP”). The HNDL problem reframes the obligations of data fiduciaries, entities that collect and control personal data, under Section 8(5) of the Act, which requires them to implement “reasonable security safeguards” to prevent personal data breaches. 

In law, the standard for “reasonable” measures is never static. It is calibrated against the state of knowledge at the time of the relevant conduct: what threats were known, what countermeasures were available, and whether fiduciaries took adequate precautions considering both. The reasonable person standard holds that liability emerges not from every harmful outcome, but from conduct that falls below what a person of ordinary prudence would have exercised in the circumstances.  

The temporal dimension of this standard is what makes it particularly significant for HNDL liability. Reasonableness does not measure conduct against knowledge that emerges later. It holds defendants accountable for risks that were known and credible at the time of the relevant decision, even if the harm itself had not yet materialized. This framework is not new to Indian data protection law. 

Section 43A of the Information Technology Act, 2000, which preceded the DPDP Act, imposed liability on bodies corporate that were negligent in maintaining “reasonable security practices and procedures” in relation to sensitive personal data. The rules notified under Section 43A pointed to IS/ISO/IEC 27001 as a benchmark for what those practices should look like, establishing that industry standards and technical benchmarks are the yardstick against which reasonableness is measured in data security contexts. This use of IS/ISO/IEC 27001 as a security benchmark by the notified erstwhile rules clarified the standard of “reasonable security practices and procedures” where both ECC and RSA encryption algorithms were used to satisfy its Annex A Control 8.24 (Use of Cryptography) as the industry standard. This means that both ECC and RSA could satisfy the data fiduciary’s duties under the erstwhile act.

The DPDP Act seems to have inherited this same logic with Section 8(5) of the 2023 Act and the definition of “reasonable security safeguards” under the 2025 Rules. However, unlike the rules notified under Section 43A, the DPDP Act does not name any benchmarks like IS/ISO/IEC 27001. Rule 6(a) of the DPDP Rules 2025 specifically states that the definition includes “appropriate data security measures, such as securing of personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to that personal data.” This particular choice in drafting gives regulatory authorities and courts of law the ability to interpret the scope of the duty of data fiduciaries to undertake reasonable security safeguards broadly, which could mean that non-quantum-resilient cryptographic algorithms fail to satisfy this duty.

After all, if the threat of Quantum Computing and the methods to avoid breaches due to it were well-known and documented when the choices regarding security safeguards were made, then it would not be a plausible defence to say that the fiduciary is not at fault under the DPDP Act and its 2025 Rules. When applied to the HNDL problem, the question becomes about what did a reasonably prudent data fiduciary know in 2026, and what was available to them to act upon? 

Constructive Knowledge: Establishing the 2026 Standard for Reasonable

The initial standard regarding the HNDL threat was set in August 2024, when the US National Institute of Standards and Technology (“NIST”) finalized the world’s first post-quantum cryptographic standards.

However, the NIST standards are merely representative of the international standards being adopted while the directly applicable regulatory signal for Indian fiduciaries is the National Quantum Mission’s Task Force Roadmap (“NQM roadmap”) published by the Department of Science and Technology in February 2026. The roadmap explicitly names the HNDL threat as a recognized driver of urgency and directs that all cryptographic transition planning proceeds under an “assume breach” principle, meaning organisations should treat the harvesting of their encrypted data as already underway. The NIST standards matter for Indian fiduciaries because the NQM roadmap explicitly adopts NIST’s standards as the migration target, making NIST the technical benchmark against which Indian compliance will be measured.

The roadmap sets out three concrete migration milestones. The first, a preparatory stage requiring organisations to inventory their cryptographic assets and initiate pilot programmes, must be completed by 2027 for Critical Information Infrastructure (“CII”) sectors, meaning defence, telecommunications, banking, and power, and by 2028 for broader enterprises. The second milestone, requiring full migration of high-priority systems and a prohibition on new classical-only deployments, is set for 2028 for CII sectors and 2030 for enterprises. The third and final milestone, full post-quantum adoption with quantum-safe trust chains throughout, falls in 2029 for CII sectors and 2033 for the broader enterprise base.

Other than these standard-defining roadmaps, the US Cybersecurity and Infrastructure Security Agency and the US National Security Agency issued joint advisories warning that nation-state actors were actively harvesting encrypted data in anticipation of future quantum capability. The threat crossed from theoretical to documented state-actor practice before most organisations had even begun to consider it, quickly becoming a national security threat recognised internationally.

The technological timeline has also accelerated sharply. Until recently, breaking RSA-2048 was estimated to require a quantum computer of approximately twenty million qubits, a scale so far beyond current hardware that the threat could reasonably be treated as distant. That estimate collapsed within twelve months. A 2026 analysis from Caltech and Oratomic found that ECC-256 could be broken in a matter of days with roughly twenty-six thousand qubits, while RSA-2048 would require approximately one hundred thousand qubits and around three months. A separate Google Quantum AI whitepaper found that ECC-256 may be vulnerable to a computer with as few as one thousand two hundred logical qubits with attack times as short as nine minutes. Giancarlo Lelli’s breaking of the 15-bit ECC encryption also shows increasing capability with time, which, while far short of the 256-bit standard used by cryptocurrencies today, still is a working proof of concept that the theoretical threat is already becoming experimental reality.

A fiduciary choosing to rely on RSA or ECC encryption today may therefore find that it offers no defence against future liability since the harm is merely deferred, while being completely foreseeable as of now. Of course, it can be argued that foreseeability of a threat or risk by a fiduciary does not necessarily mean that liability exists on the part of the fiduciary if there are no reasonable measures that can be taken to counter such threats, however current policy developments, domestic and foreign, provide actual methods to migrate to encryption algorithms that are resistant to this new method of attack without placing any impossible burden on fiduciaries.

What Compliance May Now Require: A Proposed Reading of the DPDP Act and its 2025 Rules

For data fiduciaries handling personal data, a legally defensible reading of Section 8(5) as of 2026 points toward the following steps broadly. The first step would be mapping every point at which encryption is used across the organisation, covering data in transit, data at rest, authentication protocols, and digital signatures. The goal is to isolate which systems rely on classical asymmetric algorithms like RSA and ECC encryption that are known to be quantum-vulnerable so that measures can be taken accordingly.

Not all data is of equal use when it comes to HNDL attacks. Data that is relevant in the long term like personal data held over long timeframes, such as health records, financial histories, biometric identifiers, and legal communications, is most sensitive. These datasets should be prioritised for migration to post-quantum cryptographic standards, with ML-KEM, meaning Module Lattice Key Encapsulation Mechanism, the key protection standard finalised by NIST in 2024, deployed as an interim protective layer during that transition. The NQM’s Roadmap acknowledges this to a certain degree by dividing the priority of migration between CII and common enterprises.

A fiduciary’s cryptographic audit cannot stop at its own systems. The 2023 Act makes it clear that a fiduciary retains responsibility for the acts of its data processors, meaning the third-party cloud providers and vendors that handle personal data on its behalf. Data processing agreements must be updated to impose quantum-resilience obligations, define migration timelines, and reserve audit rights. Where a processor is unwilling or unable to meet those obligations, the fiduciary must consider whether to continue that relationship because, as the IBM report earlier suggested, 82% of data breaches involved cloud stored data.

Migration efforts should be benchmarked against the NQM Task Force’s phased deadlines. A fiduciary that can demonstrate documented alignment with those milestones, through a credible migration plan with assigned accountability and measurable progress, is in a materially stronger position before the Data Protection Board of India than one that is aware of the roadmap and has chosen not to act.

“Reasonableness” under Section 8(5) will most likely be tested after either a data breach or a regulatory audit, which means that the fiduciary must maintain documentation showing compliance with regulatory standards. A fiduciary that took every correct technical step but kept no record of having done so is in a weak evidentiary position. Compliance therefore requires an auditable paper trail: the findings of the cryptographic audit, the rationale for risk-stratification decisions, migration timelines, updated processing agreements, and board-level sign-off on the overall quantum-resilience strategy.

It is important to understand that compliance is necessary with Section 8(5) of the 2023 Act because the penalties for a breach due to an HNDL attack may reach up to two hundred and fifty crore rupees as prescribed under the DPDP Act for violations related to Section 8(5) of the Act.

Conclusion

The liability question posed by the HNDL problem cannot be deferred until quantum computing capability fully matures. The legal exposure arises now, in the cryptographic choices data fiduciaries make today, because the harm, though it may not materialise for years, is already foreseeable. Three developments make this clear: the NIST post-quantum standards finalised in 2024, the NQM Task Force roadmap published in early 2026, and the documented practice of nation-state actors harvesting encrypted data in anticipation of future decryption capability.

Together, these developments mean that the window in which RSA and ECC can credibly be described as “reasonable security safeguards” under Section 8(5) of the Digital Personal Data Protection Act, 2023 is closing. For fiduciaries that store or transmit long-retention personal data, the time to act is not when quantum decryption becomes feasible. By then, the harvest will long since have occurred, and the question before the Data Protection Board will not be whether harm was foreseeable, but why nothing was done about it when it clearly was foreseeable.

**Utkarsh Rai is a B.B.A. LL.B. (Hons.) student at National Law University Nagpur.

**Disclaimer: The views expressed in this blog do not necessarily align with the views of the Vidhi Centre for Legal Policy.