People

Careers

Corporate

Commercial

Employment

News & Insights

Blog

News

Videos

Who we are

Environment & Sustainability

Diversity, Equity & Inclusion

WONDER Foundation

Get legal updates and practical guidance straight to your inbox.

You’ve successfully signed up to the Linnear Legal mailing list

Home

Resources

Registered in England &amp; Wales at 73 Shelton Street, Covent Garden, London, WC2H 9JQ
<a href="tel:+442081596000">Tel: +44 (0)20 8159 6000</a>
Company Nr: 15894546
ICO Registration Nr:  ZB842887
VAT Registration Nr: 484 5226 73
Linnear Legal is an unregulated legal services provider, meaning the firm itself is not regulated by the Solicitors Regulation Authority (SRA). However, the solicitors employed by the firm are individually regulated by the SRA. Please see our Terms and Conditions for further information on our regulatory status, complaints procedure and insurance arrangements.

Terms & Conditions

Cookie Policy

Privacy Policy

Services

Insights

About

We are driven by doing things differently, from every angle. 

Taking our Carbon Neutral Certified  status seriously.  

Putting equity and inclusion at the heart of everything we do.

Supporting sustainable employment and gender equality with WONDER. 

WONDER foundation

Contact us

Quantum computing is fast becoming one of the most pressing cybersecurity concerns for businesses. With growing global investment and warnings from UK intelligence agencies, the risk of a cryptographic breach is no longer theoretical. We help you understand how quantum breakthroughs could threaten encrypted data and why proactive awareness is essential for long-term business resilience. 

Quantum computing could break encryption within years. Is your business prepared?

In recent months, UK authorities such as the <a href="https://www.ncsc.gov.uk/collection/cyber-assessment-framework">National Cyber Security Centre</a> (NCSC) – part of intelligence and security organisation GCHQ – and the Information Commissioner’s Office (ICO) have issued <a href="https://www.ncsc.gov.uk/news/pqc-migration-roadmap-unveiled">guidance</a> and <a href="https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/ico-tech-futures-quantum-technologies/">reports</a> on the emerging cybersecurity threats posed by quantum computing to personal data and cybersecurity.
The NCSC’s recent 10-year warning to UK businesses, as discussed below, is part of a growing international consensus that quantum computing could reshape the global threat landscape. For businesses and governments, especially those that depend on encryption to protect critical infrastructure, data and communications, the risks are especially acute.
While artificial intelligence has dominated the news cycle since OpenAI first launched ChatGPT to the public in late 2022, quantum computing may soon overshadow it. Tech giants including Google, IBM, Amazon and Microsoft are investing billions in the race to build commercially viable quantum computers. According to a <a href="https://globalriskinstitute.org/publication/2023-quantum-threat-timeline-report/">2023 report by the Global Risk Institute</a>, experts estimate a one-in-three chance of a disruptive quantum event &#8211; often dubbed ‘Q-Day’ &#8211; occurring within the next decade.
Some experts even think it’s possible that Q-Day has already happened. Infamously, during the Second World War, when the Enigma cypher machine was cracked by codebreakers at Bletchley Park, it wasn’t announced to the world. It wasn’t public knowledge until decades later.
<h2>Q-Day and the encryption crisis</h2>
Q-Day refers to the moment when a quantum computer becomes powerful enough to break the cryptographic algorithms currently used to secure online communications, banking systems, national infrastructure and military communications. Unlike classical computing, which operates in linear 0s and 1s, quantum computing uses quantum bits, or qubits, capable of existing in multiple states at once due to quantum phenomena such as <a href="https://quantumatlas.umd.edu/entry/superposition/">superposition</a> and <a href="https://quantumatlas.umd.edu/entry/entanglement/">entanglement</a>. This allows for dramatically more powerful computations, and with it, the capacity to break traditional encryption methods such as RSA2048 and ECC in minutes rather than millennia (as is the case with classical computing).
The most well-known threat involves <a href="https://www.classiq.io/insights/shors-algorithm-explained">Shor’s algorithm</a>, developed in 1994, which offers an efficient method for factoring large numbers – the foundation of modern asymmetric encryption. Although no existing quantum machine can yet handle the complexity required to break RSA2048, tech giants around the world including Google, Microsoft, IBM and Intel are betting the house on that day coming soon. All that’s needed is for a quantum computer to be developed that’s powerful enough to handle the algorithm.
More troubling still is the concept of ‘store-now, decrypt-later’ attacks. State actors and sophisticated cybercriminal groups are believed to be harvesting encrypted data today in anticipation of future decryption. In recent years, there have been significant incidents of large-scale internet traffic rerouting – such as <a href="https://www.theglobeandmail.com/politics/article-china-telecom-hijacked-internet-traffic-in-us-and-canada-report/" target="_blank" rel="noopener">China Telecom’s 2016 redirection of Canadian data</a>, and <a href="https://www.securityweek.com/russian-telco-hijacked-internet-traffic-major-networks-accident-or-malicious-action/" target="_blank" rel="noopener">Russia’s 2020 diversion of traffic from over 200 major tech networks</a> – raising alarms that data is already being quietly stockpiled.
<h2>Transitioning to post-quantum cryptography</h2>
In response, governments and standards bodies have accelerated efforts to develop post-quantum cryptography (PQC) – cryptographic systems resistant to quantum attacks. In 2022, the <a href="https://www.nist.gov/">US National Institute of Standards and Technology</a> (NIST) launched a global competition to develop and standardise quantum-resistant encryption algorithms. By 2024, it had finalised its first three PQC standards (FIPS 203, 204 and 205), and President Biden issued an executive order mandating that federal agencies adopt these standards ‘as soon as practicable’, replacing the original 2035 deadline.
Similarly, in Europe, the European Commission and the <a href="https://www.enisa.europa.eu/">European Union Agency for Cybersecurity</a> (ENISA) are coordinating a continent-wide strategy to prepare infrastructure and public services for a post-quantum future. Their efforts include a harmonised transition roadmap, cryptographic agility guidance and policy recommendations designed to mitigate systemic vulnerabilities across sectors.

Stephen Almond

Quantum computers could one day break widely used cryptographic algorithms that help protect everything from personal data to national security information. While quantum computers powerful enough to do this may be many years, or even decades away, |the process of preparing for such a shift has already begun|.

<h2>10-year warning to UK businesses</h2>
In March 2025, the NCSC issued a stark warning to UK businesses: begin preparing now for a quantum future or risk falling behind on security. This followed an earlier 2024 report from the ICO, which explicitly linked quantum computing to a new category of cyber risk that could place businesses in breach of existing data protection laws if unaddressed.
As Stephen Almond, director of regulatory risk at the ICO, put it: ‘Quantum computers could one day break widely used cryptographic algorithms that help protect everything from personal data to national security information. While quantum computers powerful enough to do this may be many years, or even decades away, the process of preparing for such a shift has already begun.’
Businesses are urged to:
<ul>
<li>Conduct a cryptographic inventory to identify where vulnerable encryption is used</li>
<li>Implement cryptographic agility, enabling rapid switching to new encryption protocols</li>
<li>Begin migrating to PQC standards for systems that handle high-risk or long-retention data</li>
<li>Train security teams in quantum risk and mitigation techniques, and</li>
<li>Review contracts to ensure vendors and partners are meeting quantum-resilient standards.</li>
</ul>
The ICO has also suggested that organisations processing sensitive data – including digital service providers, healthcare companies and financial institutions – should begin transitioning to quantum-safe systems well before 2030.
<h2>Cybersecurity and the legal perspective</h2>
The legal community is beginning to grapple with the implications of quantum computing for data protection, contract law, regulatory compliance and national security. While most current legislation is technology-neutral, it’s becoming increasingly clear that existing frameworks – such as the UK <a href="https://gdpr-info.eu/">GDPR</a>, the <a href="https://digital-strategy.ec.europa.eu/en/policies/nis2-directive">NIS2 Directive</a> and the <a href="https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act">Cyber Resilience Act</a> – will be interpreted to require firms to future-proof their security.
Under <a href="https://gdpr-info.eu/art-32-gdpr/">article 32</a> of the GDPR, for example, organisations are obliged to adopt ‘appropriate technical and organisational measures’ to ensure data security. What counts as appropriate changes with the state of the art. As post-quantum cryptography becomes the new benchmark, firms that delay adoption may find themselves exposed to legal liability for data breaches involving foreseeable risks.
In addition, regulators may begin scrutinising data retention practices more closely, particularly where encrypted archives could become compromised once quantum decryption becomes viable. Businesses and their legal and compliance teams should therefore begin integrating quantum considerations into their risk registers, vendor management and data protection impact assessments.
From a commercial perspective, organisations drafting contracts today should anticipate tomorrow’s risks. Legal clauses that require ‘state-of-the-art’ security protections or data handling methods may soon include explicit reference to quantum resilience. Procurement policies, SLAs and DPAs should be reviewed accordingly.
<h2>YQK: apocalypse or Millennium Bug 2.0?</h2>
It is important that businesses are aware of the potential risks associated with quantum computing. But an awareness of its risks doesn’t detract from the potential benefits it might bring. As advocates for quantum computing are keen to point out, its capacity to process data exponentially faster than classical machines could revolutionise fields like materials science, pharmaceuticals, logistics and artificial intelligence.
Quantum simulations could dramatically shorten the timeline for drug discovery, enabling highly personalised medicine based on individual genetic profiles. Optimisation problems could be solved in seconds rather than weeks. Even in cybersecurity, quantum technologies may yield new forms of ultra-secure communication, such as quantum key distribution (QKD), which is theoretically immune to interception.
Nevertheless, realising this potential will depend on whether the opportunities can be developed in tandem with robust safeguards. Quantum computing is not inherently malign. Like all transformative technologies, it requires governance.
If and when ‘Q-Day’ comes, who knows how the world might change. It may be the case that we enter a post-privacy world or a world where privacy is available only to the privileged few who can afford the technologies to safeguard their data (arguably, such a world already exists).
It may also be the case that legislative drives help us get up to speed with the threat that quantum computing poses after all, and the dangers never materialise. In such a scenario, Q-Day would be another Y2K, a millennium bug 2.0 – in other words, a bit of a damp squib. But that’s exactly what organisations and governments around the world are hoping for.
For more insights on legal developments in cybersecurity and data, take a look at our <a href="https://www.linnearlegal.co.uk/news-insights/tag/ai-technology/">series on technological trends and developments</a>.

The countdown to Q-Day is accelerating, and UK authorities are urging businesses to take the threat of quantum decryption seriously before it reshapes the cybersecurity landscape.

Why businesses should begin preparing for quantum computing threats now

Quantum computing could break encryption by 2035. Find out what UK businesses must do now to stay secure and legally compliant.

Why businesses should begin preparing for quantum computing threats now | Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/04/shutterstock_2502925833.jpg

Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/01/Linnear-Legal-logo.png

https://secure.gravatar.com/avatar/557c7f891380b6950d58942a774782ca?s=96&d=mm&r=g

Why businesses should begin preparing for quantum computing threats now

Related Insights