Encryption Impact - Enabling Encryption vs Encrypting Data

Question

This is more of a curiosity question. I have went through and encrypted ~50 fields in a sandbox with existing data. There are more fields I would like to encrypt, but they will take some more work and analysis to see what we will need to modify to get them to work. My question is more or less 2 fold.

1. Will we see the impacts of what we will need to change throughout the org as it sits now? Meaning the field is encrypted, but none of the data actually is? Meaning from a testing perspective, will I produce any issues once I actually encrypt the previously loaded data? Ow should they have already surfaced when I attempt to encrypt the field.
2. Is there any reason to wait to encrypt all the data in all the fields at once? Or is it fine to encrypt the data in the fields/objects I have encrypted now, and circle back to encrypt the fields that may take more analysis.

Any information you can provide will be greatly appreciated!!

Answer 1

I presume you are talking about Platform Encryption

Will we see the impacts of what we will need to change throughout the org as it sits now? Meaning the field is encrypted, but none of the data actually is? Meaning from a testing perspective, will I produce any issues once I actually encrypt the previously loaded data? Ow should they have already surfaced when I attempt to encrypt the field.

Well, it depends. When you identify a field to encrypt, the platform tells you whether that is possible so, assuming got past that barrier, you then have to consider whether things users used to expect to work still work.

For example, searches become case sensitive in certain use cases. For example, if code searches for a Contact using an upper case email, the Contact will not be found.

• Considerations
• Deterministic Encryption Considerations

Is there any reason to wait to encrypt all the data in all the fields at once? Or is it fine to encrypt the data in the fields/objects I have encrypted now, and circle back to encrypt the fields that may take more analysis

I think it is fine to do a staged rollout due to the points raised above - you may discover that application behavior is not as you expect once fields are encrypted and better to have fewer fields encrypted to discover this.

Answer 2

1. You'll start to see some impact up front, but you should still encrypt the pre-existing data. This is especially true for deterministic data - you should always encrypt/re-encrypt that right after key rotation. For non-LTA fields you can initiate the encryption process yourself from the encryption statistics page. For LTA fields and/or Files, Chatter, etc you will need to contact support.

2. There's no reason to wait. It's actually preferable that you don't wait.