A fairly common reason Council IoT projects stall is when somebody raises security and privacy questions. Is the data secure? Can the sensors be hacked? Are we GDPR-compliant? These are all valid concerns, and addressing them is often simpler than you think.
This article explains how data is secured in LoRaWAN IoT deployments, how to spot use cases where privacy needs extra attention, and what “good” looks like for councils. If you want to discuss your specific project, please get in touch.
Data security
Two common questions here are along the lines of :
- “Can the sensors be hacked and turned into a DDoD botnet?” – which is something that made the news with wifi cameras in the past; and
- “Can somebody intercept the sensor data and read it or change it?”
Turning the sensors into a botnet
One of the less talked about differences between LoRaWAN and other network technologies like NB-IoT or WiFi is that LoRaWAN devices are not directly connected to the internet, whereas your wifi device or NB-IoT camera has an IP address. It is LoRaWAN gateways rather than sensors that are connected to the internet and have an IP address.
In an IoT network of 1,000 sensors a LoRaWAN network might only have 10 IP addresses, whereas a WiFi or NB-IoT network would have 1,000 IP addresses. In this example the attack surface of the LoRaWAN network is 100 times smaller than a similarly sized WiFi or NB-IoT network.
That doesn’t mean there’s no risk! But it means we can put our efforts into making sure the 10 internet connected LoRaWAN gateways are properly secured: ports locked down, strong passwords, firmware up to date, and separate from the corporate network.
Intercepting sensor data
LoRaWAN networks use strong end-to-end encryption (AES 128-bit encryption), which for all intents and purposes means that only you (or your application) can decrpyt the messages and read them. The gateway owner/operator can only see the encrypted messenger.
The 256-bit 3GPP encryption used by the mobile networks and NB-IoT is stronger than LoRaWAN encryption, although the NB-IoT carrier network operator is able to see the message, so it is quite common for solution providers to add another layer of encryption that the carrier cannot see.
| LoRaWAN | NB-IoT | |
|---|---|---|
| Encryption | AES-128 end-to-end | 256-bit 3GPP (stronger) |
| Who can decrypt your data? | Only you | Carrier network can see it |
| Attack surface | Gateways only | Every sensor |
| Data path | Sensor → your gateway → your server | Sensor → carrier network → your server |
Neither is “insecure” – they just have different threat models. For most council use cases, LoRaWAN’s air-gapped sensors and end-to-end encryption is a good fit.
Data Privacy
Most council IoT use cases – parking sensors, bin monitors, air quality – don’t collect personal data. The sensors watch infrastructure, not people. UK GDPR concerns are minimal.
Social care IoT deployments can have higher privacy stakes than say air quality sensors. If you have sensors in someone’s home monitoring whether they’re in bed, in the bathroom, or have left the apartment – then you are dealing with sensitive personal information, and you need to comply with data privacy and data protection law. That’s why they require:
- Legal groundwork: DPIAs, DPAs, consent frameworks
- Technical safeguards: Encryption, access controls, audit logs
- Ongoing governance: Regular reviews, consent renewals, oversight
This is not a barrier – it is responsible stewardship of vulnerable citizens’ data. With good planning and partnership between solution provider and council, these deployments can be transformational while fully respecting privacy rights.
Work with your Data Protection Officer early in the project to conduct full DPIA. Your solution provider may have been through the process before, which will definitely help. If your council owns the LoRaWAN gateways and network server then all data stays under your control, which makes for simpler governance.
Related guides:
- Which IoT network is best for local government? – explains all four technology options and the strategic decision of who runs your network
- LoRaWAN vs cellular (NB-IoT/LTE-M): what councils need to know – deep dive on the future of cellular IoT and why we’re cautious about NB-IoT
- So you’ve built a dashboard – what next? Making IoT data deliver value (coming soon)