Transferring Personal Data by USB Device: GDPR Requirements

Update: October 2026

A USB stick holds a lot of personal data and fits in a pocket. That makes it easy to lose, leave in a laptop, or send to the wrong person. A lost drive is a personal data breach, and the organisation that owned the data is responsible.

This guide covers GDPR security rules for USB devices, how to encrypt a drive and share the key, what to do when a drive goes missing, and what the ICO has said in its enforcement work.

Key Takeaways

• Article 32 GDPR requires security appropriate to the risk and lists encryption as an example of an appropriate measure. The ICO says organisations should use encryption when they store personal information on removable media such as USB drives, and should consider whether a safer way of moving the data exists.

• Encrypting a drive only works if the key stays separate. The ICO says not to send the password with the device or in the same email as an encrypted file, and to share it through a different channel, such as a phone call after delivery is confirmed.

• A lost or stolen device holding personal data is a personal data breach. If it is likely to pose a risk to people, the supervisory authority must be notified within 72 hours of becoming aware. Encryption can change whether individuals must be told, but it does not remove the duty to assess the breach.

The Security Principle covers a USB Drive

Article 5(1)(f) requires personal data to be processed with appropriate security, including protection against unauthorised processing and accidental loss. Article 32(1) turns that into a duty to implement technical and organisational measures appropriate to the risk, taking into account the state of the art, cost, and the nature, scope, context and purposes of the processing. It names pseudonymisation and encryption as examples. The ICO applies this under the UK GDPR, and the security duty in the EU GDPR is similarly shaped.

The ICO says the law does not require encryption of all personal information. It says organisations should use encryption when they hold personal information on removable media, because encryption is widely available and low cost. It adds that businesses should consider more appropriate ways to transport or store data, since removable media is easy to lose and can carry malware. The ICO also notes that a lost drive can make it difficult to comply with other obligations, such as answering a subject access request.

A Short Risk Assessment Decides Whether USB Is the Right Tool

Before using a drive, the ICO’s security guidance asks you to assess the risk by considering the sensitivity of the data and the damage or distress if it were compromised. A drive holding a staff phone list carries a different risk from one holding health records or a case file.

The NCSC’s guidance on peripherals describes the risk of removable media as data theft or loss, where data may not be encrypted or protected by device authentication, and there is no way to restrict access or wipe it once the device is lost. It also notes that removable media can provide a route for malicious software to bypass approved installation processes. It advises assessing the business need for each external interface, setting a policy, using device management where possible, and turning off interfaces that aren’t needed.

If the transfer can go through a secure managed channel, that is the lower-risk choice. A drive is justified only when there is a real business reason, such as when a recipient has no other route.

Three Controls Keep Personal Data Off Unprotected Drives

The ICO sets out three main ways to avoid storing unencrypted personal information on USB devices. The first is to prohibit or restrict staff use of USB storage. The second is blocking organisation devices from connecting to USB devices, or preventing unauthorised access to the data, through staff training, enforcement or technical controls. The third is restricting how the organisation’s devices interact with USB devices, which the ICO describes as good practice for wider cyber security.

Where there is a business need, the ICO says to put policies and staff training in place and to encrypt the whole device, or to encrypt the files that hold personal information before they go on it. It notes that whole-device encryption is generally stronger and easier to enforce than device restrictions. A common Windows tool is BitLocker.

File Encryption and Containers Are the Alternative

Encrypting individual files or placing groups of files in an encrypted container also protects the data, even though the files remain visible on the drive. The ICO names VeraCrypt as a free option and says archive software and office applications often include encryption.

Check that a password feature encrypts the data. In some applications, a password does not encrypt the underlying content. The ICO also lists encryption mistakes: storing the password in an unencrypted text file next to the files, using the file name as the password, or sending the password in the same email as an encrypted attachment. The recipient needs compatible software to open the files, and that can be a problem in corporate environments that restrict software installation or external drives.

The Key Has to Travel Separately

When a drive is posted, the ICO says to consider the device type, data format, information sensitivity, and transport security. A recorded delivery or specialist courier gives assurance that the intended recipient signed for it, although it does not remove the risk of loss.

Share the password over a separate communication channel. The ICO’s example is a phone call once delivery is confirmed. Do not put the password in the same envelope as the drive. That removes the protection encryption offers.

Our guide to common GDPR mistakes covers broader procedures that support this, such as breach and request handling.

A Drive Sent Abroad Is Also a Chapter V Transfer

This guide is about the security of moving data on physical media. If the drive goes to a recipient in a country outside the EU or UK, the Chapter V rules on international transfers apply too. You then need a transfer route, such as an adequacy decision or standard contractual clauses, and a secure method. See our guide to transferring personal data outside the EU.

Encryption Leaves Residual Risks

The ICO states that encryption reduces risk and does not remove it. An encrypted drive that is left unlocked, or a container left mounted after use, exposes the data. Malware with the right permissions can read data once a user has unlocked it. If the key is lost, nobody can decrypt the data, and the ICO says that can itself be a personal data breach because the data is no longer available.

Keep a process for managing keys and passwords so a forgotten password doesn’t lock the organisation out of its own records.

A Lost Drive Triggers the Breach Process

The ICO’s breach guidance lists lost or stolen computing devices containing personal data as an example of a personal data breach. Under Article 33, you must report a breach that is likely to result in a risk to people to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk, the people affected must be told directly without undue delay. Record every breach, whether or not it is reported.

Encryption affects the assessment. The ICO says encryption can reduce the impact of a breach and therefore determine whether individuals must be told, for example, where the data is unintelligible to anyone unauthorised. The organisation must still check whether it has to tell the regulator. Record the reasoning either way.

A practical response plan for a lost drive needs a named person to receive reports, a quick way to establish what the drive held and whether it was encrypted, and a template for the notification. The ICO’s personal data breaches guide sets out what a notification must include.

The ICO Has Acted on Unencrypted Drives

In January 2024, the ICO issued an enforcement notice to the Crown Prosecution Service after it lost an unencrypted USB stick containing a case file about historic child abuse. The ICO found the CPS had no appropriate measures to prevent people downloading personal information to devices such as USB sticks, and that neither the documents nor the device were encrypted. The notice required the CPS to make sure USB storage devices complied with its data protection policies, including through device or file encryption.

The case shows two failures regulators look for: no technical control over what can be copied to a drive, and no encryption on the drive itself. The ICO’s encryption scenarios guidance sets out the case and the expectations for sending data on physical media.

A USB Policy Brings the Controls Together

A short policy should state when a drive may be used, who can approve it, which encryption standard applies, how passwords are shared, how drives are logged in and out, and who to tell when one goes missing. Back it with technical controls: device management to block unapproved drives, and encryption enforced on approved ones. Train staff on the policy and check that it is followed.

Review the policy against the NCSC’s peripheral security guidance, which covers USB data blockers and disabling interfaces that are not required. GDPRLocal helps organisations draft security policies and risk assessments, and prepare breach procedures. See our GDPR consultant services.

Conclusion

A USB drive can be used lawfully for personal data when the risk has been assessed, the drive or the files are encrypted, the key travels separately, and a breach process is ready. The safest first question is whether another channel would do the job.

The ICO’s expectations are consistent: encrypt removable media, control what can be copied to it, and show the measures were in place. The 2024 enforcement against the CPS shows that missing both leads to formal action.

Frequently Asked Questions

Is It Legal to Transfer Personal Data on a USB Stick Under GDPR?

Yes, if the security is appropriate to the risk. Article 32 lists encryption as an appropriate measure, and the ICO says organisations should use encryption when storing personal information on removable media. Consider first whether a safer channel is available.

How Should We Send the Password for an Encrypted USB Drive?

Send it through a different channel from the drive itself. The ICO’s example is telling the recipient the password by phone once delivery is confirmed. Don’t include it in the same package or in the same email as an encrypted attachment.

What Should We Do if an Employee Loses a USB Drive With Personal Data?

Treat it as a personal data breach. Establish what the drive held and whether it was encrypted, assess the risk to people, and notify the supervisory authority within 72 hours of becoming aware if a risk is likely. If the risk is high, tell the individuals directly, and record the incident either way.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.