Now you can take your encryption settings with you when you deploy customizations from one org to another. You can also apply encryption to components that are already part of a change set. Your encryption settings are applied to the target org when your change set is uploaded to your target org.
Most customers try Shield Platform Encryption features in a sandbox before using them in production orgs.
Basically you could do it either ways by enabling it in production or
preferably by deploying using change sets or IDE. When you
deploy Shield Platform Encryption to your org with a tool such as
Force.com IDE, Migration Tool, or Workbench, the Encrypted field
attribute persists. However, if you deploy to orgs with different
encryption settings, the effect depends on whether Shield Platform
Encryption is enabled in the target org.
Regardless of how you deploy, Salesforce automatically checks to see if the implementation violates Shield Platform Encryption guidelines.