PIN authenticated
hardware encrypted

Implement “appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption of personal data” (Article 32, Security of processing).

In the event of a data breach, the organization is not required to inform individuals of the breach if measures that “render the personal data unintelligible” were in place, including encryption (Article 34, Communication of a personal data breach to the data subject).