What is a data recovery agent?
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Definition
A data recovery agent is a person or role authorized to unlock encrypted data when its owner can't, by using backed-up key information. NIST calls the closest term a key-recovery agent.
- Category
- Security
- Also called
- recovery agent, key recovery agent, DRA
- Last updated
Sources checked: csrc.nist.gov
Last verified against the official page:
Encrypted data is useless without its key. If the person who holds the key loses it, leaves the company or forgets the password, the data is gone too. A recovery agent is the fallback: someone formally allowed to get the data back.
NIST defines the closest term, a key-recovery agent, as "a human entity authorized to access stored key information in key backups and archives". In another NIST publication it is a role that assists the key-recovery process. NIST defines key recovery itself as the mechanisms and processes that let authorized entities retrieve or reconstruct keys from key backups or archives.
The exact name varies by product. "Data recovery agent" is the label some systems use, and others say key recovery agent. The idea is the same.
Why it matters to you
A recovery agent is a deliberate second way into your data. That helps when an employer needs to unlock a laptop after someone leaves. It also means whoever holds that role has real power, and the backed-up keys need the same protection as the originals.
Recovery agent vs. password reset
A password reset gets you back into an account. A recovery agent gets back the key that decrypts stored data. If the data was encrypted with a key that was never backed up, no agent can help.
How to protect yourself
- 1
Know who can recover your data
If an employer or school manages your device, ask whether recovery keys are backed up and who is authorized to use them.
- 2
Store recovery keys somewhere separate
Keep backup keys and recovery codes apart from the device they unlock, in a password manager or a locked drawer, not in a note on the same laptop.
- 3
Limit who holds the recovery role
For a business, name as few recovery agents as you need and review the list when people change roles.
- 4
Turn on two-step verification
Protect the accounts that hold your recovery keys with two-factor authentication.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is key recovery?
NIST defines it as the mechanisms and processes that let authorized entities retrieve or reconstruct keys and other key information from key backups or archives.
Is a data recovery agent the same as a key recovery agent?
The names are used for the same idea. NIST's glossary lists key-recovery agent, a human entity authorized to access stored key information in key backups and archives.
Can a recovery agent read my data?
If they hold your recovery key, yes, which is why the role should be tightly controlled.
Sources
- Key-recovery agent - Glossary · csrc.nist.gov
- key recovery - Glossary · csrc.nist.gov
Something wrong or out of date? Tell us and we'll re-check it.