diff --git a/src/ble/gatt_client.c b/src/ble/gatt_client.c
index b9cf1dbb2..bf1b9d335 100644
--- a/src/ble/gatt_client.c
+++ b/src/ble/gatt_client.c
@@ -710,15 +710,33 @@ static uint8_t * setup_long_characteristic_value_packet(uint8_t type, hci_con_ha
 #endif
 }
 
+// test if notification/indication should be delivered to application (BLESA)
+static bool gatt_client_accept_server_message(hci_con_handle_t con_handle){
+#ifdef ENABLE_LE_CENTRAL_AUTO_ENCRYPTION
+	// only check as Central
+	if (gap_get_role(con_handle) == HCI_ROLE_SLAVE) return true;
+
+	// ignore messages until re-encryption as central is complete
+    if (gap_reconnect_security_setup_active(con_handle)) return false;
+
+	// after that ignore if bonded but not encrypted
+	return !gap_bonded(con_handle) || (gap_encryption_key_size(con_handle) > 0);
+#else
+	return true;
+#endif
+}
+
 
 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes 
 static void report_gatt_notification(hci_con_handle_t con_handle, uint16_t value_handle, uint8_t * value, int length){
+	if (!gatt_client_accept_server_message(con_handle)) return;
     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_NOTIFICATION, con_handle, value_handle, value, length);
     emit_event_to_registered_listeners(con_handle, value_handle, packet, characteristic_value_event_header_size + length);
 }
 
 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes 
 static void report_gatt_indication(hci_con_handle_t con_handle, uint16_t value_handle, uint8_t * value, int length){
+	if (!gatt_client_accept_server_message(con_handle)) return;
     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_INDICATION, con_handle, value_handle, value, length);
     emit_event_to_registered_listeners(con_handle, value_handle, packet, characteristic_value_event_header_size + length);
 }