KNX Data Secure encrypts telegrams at the application layer (Group Object), whereas KNX IP Secure encrypts at the transport layer (between IP Routers).

The key distinction: Data Secure provides encryption and authentication at the application layer, end-to-end between devices, protecting the value of a Group Object regardless of the medium in between. IP Secure provides encryption at the IP transport layer, between IP Routers or via tunnelling, protecting the IP traffic but remaining transparent for the TP devices downstream. Both mechanisms can coexist in the same installation and are commonly deployed together.

Think of it as Data Secure = protect the message, IP Secure = protect the pipe — they answer different threats and are complementary, not redundant.