Between quantum computing and privacy

data protection challenges in a post-quantum landscape

Abstract

The emergence of quantum computing challenges the cryptographic foundations underpinning information security, personal data protection, and privacy. This article examines the extent to which quantum computational capabilities may undermine the technical assumptions embedded in regulatory frameworks such as the General Data Protection Law (LGPD) and the General Data Protection Regulation (GDPR), particularly regarding security, anonymization, and risk management. It argues that the post-quantum transition extends beyond the replacement of cryptographic algorithms, constituting a legal and regulatory challenge that requires revising re-identification criteria, adopting risk-based governance, implementing crypto-agility policies, and promoting proactive action by data protection authorities. The study employs a qualitative, theoretical, bibliographic, and documentary methodology, analyzing scientific literature, legal frameworks, and national and international institutional documents. The findings indicate that post-quantum cryptography represents the primary response to mitigating quantum risks, whereas Quantum Key Distribution should be approached cautiously due to its practical limitations and dependence on specialized infrastructure. The article concludes that preparing for the post-quantum era requires integrating science, regulation, and public trust to preserve the effectiveness of personal data protection and privacy in the face of emerging technological risks.