Organisations are required to use appropriate technical and organizational measures to ensure confidentiality, integrity and availability of systems and services and the personal data processed within them, test the effectiveness of such safety measures, and encrypt data and devices whenever possible.
Note, if data can be truly anonymized, then it is outside the scope of GDPR. If data cannot be anonymized, companies should consider pseudonymisation.