When situations must data at rest be encrypted?

Data at rest must be encrypted when it contains sensitive or confidential information, such as personally identifiable information (PII), financial records, or intellectual property, to protect it from unauthorized access. Encryption is essential when data is stored on devices that may be lost or stolen, such as laptops or external drives. Additionally, compliance with regulations like GDPR, HIPAA, or PCI DSS often requires encryption to safeguard data at rest. Implementing encryption also helps mitigate risks associated with data breaches and enhances overall data security.