What is data at rest?
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Definition
Data at rest is information kept in storage, such as files on a laptop, photos on a phone, rows in a database or a backup, rather than being sent across a network or used in memory.
- Category
- Security
- Also called
- data-at-rest, DAR, stored data
- Last updated
Sources checked: csrc.nist.gov, nvlpubs.nist.gov
Last verified against the official page:
Security teams sort data into states. Data at rest is the stored kind: it sits on a disk, a phone, a USB stick, a cloud storage bucket or a backup tape and isn't moving. NIST's big data framework draws the same line, treating data at rest as persisted data and contrasting it with data in motion, which is traversing a network or sitting briefly in a computer's memory.
A concrete example: your photos, scanned passport and tax returns on a laptop are data at rest. Send one of them in an email and that copy becomes data in motion. Open it in an editor and it is data in use. Each state has its own risks and its own fixes.
Why it matters to you
Stored data is what thieves go after. A lost phone, a stolen laptop or a company database that gets breached all expose data at rest. If the storage isn't encrypted, whoever holds the device or gets into the system can read the contents. Encryption turns the stored data into unreadable text without the key, so a stolen drive is far less useful to the person who took it.
It also explains why a breach at a company you've never thought about can still touch you. Your name, address and email sit in its databases as data at rest, and your protection depends on how well that company secured them.
Data at rest vs. data in transit
- Data in transit (or in motion) is data moving between places, such as a page you load or a message you send. It is protected by encrypted connections like HTTPS.
- Data at rest is data stored. It is protected by storage encryption, access controls and good backups.
You usually need both. A site can use HTTPS and still keep your details in an unencrypted database.
How to protect yourself
- 1
Turn on full-disk encryption
Phones encrypt storage once you set a passcode. On a laptop, switch on BitLocker (Windows) or FileVault (Mac). A stolen laptop is then much less of a risk.
- 2
Lock every device
Use a strong passcode or password, set a short auto-lock timer, and enable Find My device so you can wipe a lost phone.
- 3
Encrypt your backups
Check that cloud and external-drive backups are encrypted, and keep one copy somewhere other than the device it backs up.
- 4
Store less sensitive data
Delete old scans of IDs and tax documents you no longer need, and clear them from downloads folders and email attachments.
- 5
Reduce what companies hold on you
Data you can't lock down yourself sits in other people's databases. Serus finds where your address and phone number are listed and removes them, which shrinks what a breach can expose.
See it in action
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between data at rest and data in transit?
Data at rest is stored on a device or server. Data in transit is moving across a network, such as an email on its way or a page loading. They are protected in different ways: storage encryption for the first, encrypted connections like HTTPS for the second.
Is data at rest encrypted by default?
Not always. Modern phones encrypt storage once a passcode is set, but laptops, external drives and many databases need encryption switched on or configured. Check your own devices rather than assuming.
Are cloud files data at rest?
Yes. Files in cloud storage are data at rest on the provider's servers. Most major providers encrypt them, but that doesn't help if someone gets into your account, so a strong password and two-step verification matter too.
Sources
Something wrong or out of date? Tell us and we'll re-check it.