GDPR and Encryption at rest

Security measures outlined in the privacy and terms are suitable for individuals but don't go far enough to be suitable for any client data that can be considered personal. As a minimum, encryption at rest should be implemented.