Post-Quantum Cryptography: How Long Must Data Stay Secret?

By DataTip · Published November 8, 2026

Post-quantum cryptography is often treated as a technology transition to schedule for later. But if encrypted records are collected now and decrypted in the future, the more immediate governance question is how long those records need to remain confidential. The R Street Institute report does not recommend changing retention policies; its concern about long-term confidentiality offers a separate lens for reviewing them.

Q-Day remains uncertain, but encrypted data collected today could potentially be decrypted in the future. The R Street Institute report identifies long-term confidentiality as a concern and says PQC prioritization should consider data sensitivity, system criticality, and transition feasibility. Reviewing how long sensitive records must remain confidential is a governance lens, not a retention recommendation made by the report.

The report frames PQC migration as a present-day risk-management issue even though no one can say when a quantum computer will be able to break widely used cryptography. For leaders, that means the timing uncertainty around Q-Day does not erase the risk that sensitive information could be exposed later. The practical question is not just which systems to migrate, but how long the information they protect must stay secret.

Why does post-quantum cryptography make data confidentiality duration relevant?

The report identifies a harvest-now, decrypt-later risk: an adversary can collect encrypted data today and attempt to decrypt it in the future, if quantum capabilities eventually make that possible. Data that needs to remain confidential for a long time is particularly exposed to this concern. The report does not prescribe retention periods; considering confidentiality duration is an editorial governance implication of its analysis.

AI GENERATED

Q-Day is the capability milestone at which a quantum computer could break cryptography protecting digital communications. Its arrival remains uncertain. The risk that can begin before it is different: encrypted information may be intercepted and stored now, while the ability to decrypt it could emerge later.

The report points to national security and intelligence information, medical records, and financial data as examples where confidentiality may need to last over time. That makes confidentiality duration relevant to how leaders assess exposure. Does a record still need to be retained, and for how long must it remain protected? Those are questions an organization can consider in its own governance process, not recommendations the report explicitly makes.

What factors should guide post-quantum risk prioritization?

The report says prioritization should weigh data sensitivity, system criticality, and transition feasibility. It also highlights long-lived data and operational dependencies. This is a risk-based approach rather than a single technology-refresh timeline: the sensitivity of information matters, but so does the importance of the system and the practical difficulty of changing it.

AI GENERATED

That combination matters because a system can protect highly sensitive records while also supporting operations that are difficult to interrupt. Critical infrastructure makes the trade-offs especially visible. These environments are highly interconnected, often privately owned, and vary in technical maturity and resource capacity, so a uniform transition is unlikely.

The report’s wider argument is that these differences call for strategic prioritization and coordination. It does not reduce the issue to data retention alone. Rather, the confidentiality lifetime question can add a governance perspective to the report’s broader risk factors: what information is involved, how critical is the system that holds or moves it, and how feasible is a transition given its operational dependencies?

What does the report recommend for federal and infrastructure readiness?

The report argues that federal leadership should move beyond high-level direction toward harmonized implementation. Its four recommendations are to align federal leadership, budgeting, and accountability; use targeted Requests for Information (RFIs) to identify implementation gaps and demonstrate possible solutions; expand pilots in high-impact environments; and use market signals and private-sector leadership to accelerate adoption.

These recommendations respond to the varied conditions across critical infrastructure. A common transition path may be difficult where ownership, technical maturity, resources, and system dependencies differ. The report therefore emphasizes coordination and practical learning, alongside industry leadership – not a single timetable that fits every organization.

For executives, that context helps distinguish two related decisions. PQC migration concerns the cryptographic systems and dependencies that need attention. The retention lens asks whether sensitive stored information needs to be held for its full current period and how its confidentiality needs relate to the time it remains in storage. The report supports the long-term confidentiality concern; it does not tell organizations to delete records, shorten retention, or apply specific additional protections.

The Post-Quantum Moment: Understanding “Q-Day” and the Urgency of Migration

Quantum computing processes information differently from classical computing. Classical computers use bits that represent either zero or one; quantum computers use qubits, which can exist in a superposition of multiple states. That difference may help quantum computers solve some problems that challenge even powerful classical systems, but the report’s focus is the potential threat to public-key cryptography.

The technology may also have beneficial uses. The report gives molecular analysis for drug discovery and fraud detection in financial modeling as examples of possible applications. Used against current public-key cryptography, however, a sufficiently powerful quantum computer could break systems such as RSA and elliptic curve cryptography (ECC), which rely on mathematical problems that quantum computers may eventually solve.

The theoretical concern has been understood for decades. Shor’s 1994 algorithm showed that a sufficiently powerful quantum computer could break widely used encryption. For much of the time since, a machine capable of running that algorithm remained a theoretical prospect, and quantum computing could feel like a distant issue rather than an operational one.

The report describes recent developments as bringing quantum capabilities closer, while noting that the systems it discusses are not yet capable of breaking encryption. It also cautions against treating Q-Day as one clear, easily detected event: its effects could be gradual and uneven, with early systems resource-constrained and used selectively. Even an ability to break encryption over months or years – not minutes – could matter when the data must remain secure for a long time.

That distinction is central to the retention question. Q-Day’s timing is uncertain; the possibility of encrypted data being collected before then is the present concern. Organizations can consider that exposure alongside system criticality and transition feasibility, without mistaking a proposed governance lens for a retention rule from the report.

The source analysis is focused on U.S. policy and critical infrastructure. Before applying its conclusions to current decisions, leaders should validate applicable organizational guidance. The report’s lasting point is narrower and more useful than a prediction about Q-Day: long-term confidentiality belongs in present-day risk discussions.

Key takeaways

• Treat confidentiality duration as a governance question prompted by harvest-now, decrypt-later exposure – not as a retention rule established by the report.
• Assess data sensitivity, system criticality, and transition feasibility together; long-lived data and operational dependencies affect the risk picture.
• Do not wait for a known Q-Day date to recognize the exposure: encrypted data could be collected before quantum systems can decrypt it.
• Expect varied transition needs across critical infrastructure because ownership, interconnectedness, maturity, and resources differ.
• The report’s policy recommendations emphasize federal coordination, targeted RFIs, high-impact pilots, and private-sector leadership.

Practical tips

• When reviewing sensitive stored records, separate the question of how long they must remain confidential from the question of how long they must be retained.
• For risk discussions, document which source-supported factors are relevant: information sensitivity, system criticality, feasibility of transition, long-lived data, and operational dependencies.
• Check current organizational and sector guidance before using the report’s policy analysis to inform present-day decisions.