Quantum Threats to Privacy: "Harvest Now, Decrypt Later" and What It Means for You

Of all the quantum-era risks this firm is asked to advise on, 'harvest now, decrypt later' is the one most likely to be underestimated, precisely because the threat is invisible today and only materialises years from now.

What the strategy involves

A sophisticated adversary — whether a state actor or a well-resourced criminal group — does not need a working quantum computer today to benefit from one in the future. They need only intercept and store encrypted data now, betting that a future quantum computer will be able to decrypt it. For data with a short useful life, this is a low-value strategy. For data that must remain confidential for a decade or more — health and genomic records, national security communications, long-term trade secrets, sensitive litigation material — it is a genuinely rational and increasingly documented threat model.

The privacy dimension

This has a distinct privacy law implication beyond conventional cybersecurity. Under frameworks like India's Digital Personal Data Protection Act, data fiduciaries are expected to implement 'reasonable security safeguards' appropriate to the sensitivity and risk profile of the personal data they hold. As post-quantum cryptography standards mature and national guidance becomes more specific, what counts as 'reasonable' for long-lived sensitive personal data is likely to shift — meaning an encryption approach considered adequate today may not remain defensible in a regulatory inquiry or breach investigation several years from now.

The practical response is not to over-encrypt everything with quantum-resistant algorithms overnight — most systems do not yet need that. It is to identify which categories of personal and sensitive data carry genuine long-term confidentiality risk, and to prioritise those for early post-quantum migration and heightened retention discipline, since data you no longer hold cannot be harvested at all.