GDPR doesn’t set specific rules for encryption or anonymisation but requires that personal data be protected. Using encryption and anonymisation is encouraged as they help secure data and comply with GDPR’s overall privacy requirements.