All personal data does not need to be encrypted. If the information is not encrypted, however, it may risk being accessed by unauthorized persons and the data controller therefore needs to assess what risks this entails and, if necessary, encrypt. The choice of encryption method (and what security is required) should also be made based on this assessment.