If organisations use cryptographic methods and products, they must consider numerous legal framework conditions. In some countries, cryptographic methods may not be used without the consent of the government, for example. This may prevent recipients located abroad from reading encrypted datasets because they are not allowed to use the required cryptographic products, which may even make them liable to prosecution.

Furthermore, using products with strong encryption is significantly restricted in many countries. Users may thus be tempted to leave sensitive data unencrypted or to protect it using insecure methods. Besides making attacks easy, this may also violate national laws. For example, a country's data protection laws may specify that adequate cryptographic methods must be used in order to protect personal data.