This article examines the disconnect between people’s social conceptions of privacy and information security in relation to encryption vis-à-vis the legal protections offered by law. It describes the social conceptions and expectations of participants based in New Zealand and contrasts these with the applicable laws and legal protections concerning privacy, information security and encryption. In light of incongruence between the social and the legal, the article recommends law and policy developments to better align and connect people’s social conceptions of privacy and information security with the legal protections provided by law. This includes having greater awareness of the relevance of civil and criminal procedure rights to privacy and information security in the context of encryption and providing stronger legal protections to the right against unreasonable search and seizure and the privilege against self-incrimination.