A data encryption computer, comprising: a processor; and a non-transitory computer-readable storage medium (1001, 1007), comprising code executable by the processor for implementing a method comprising: receiving a plurality of sensitive data records comprising personal information of different users; identifying one or more searchable fields for the sensitive data records, wherein each searchable field is associated with a subset of the personal information for a user; generating (403, 503, 507, 509) a searchable field index for each of the one or more searchable fields; and encrypting the sensitive data records using a database encryption key, the data encryption computer characterised in that the searchable field index for each of the one or more searchable fields is generated (403, 503, 507, 509) based on a sensitivity level of the searchable field, wherein: when the searchable field corresponds to a non-sensitive level, the searchable field index is a plain text of the searchable field; when the searchable field corresponds to a sensitive level, the searchable field index is a hash value of the searchable field; and when the searchable field corresponds to a highly-sensitive level, the searchable field index is an encrypted hash value of the searchable field. a processor; and a non-transitory computer-readable storage medium (1001, 1007), comprising code executable by the processor for implementing a method comprising: receiving a plurality of sensitive data records comprising personal information of different users; identifying one or more searchable fields for the sensitive data records, wherein each searchable field is associated with a subset of the personal information for a user; generating (403, 503, 507, 509) a searchable field index for each of the one or more searchable fields; and encrypting the sensitive data records using a database encryption key, the data encryption computer characterised in that the searchable field index for each of the one or more searchable fields is generated (403, 503, 507, 509) based on a sensitivity level of the searchable field, wherein: when the searchable field corresponds to a non-sensitive level, the searchable field index is a plain text of the searchable field; when the searchable field corresponds to a sensitive level, the searchable field index is a hash value of the searchable field; and when the searchable field corresponds to a highly-sensitive level, the searchable field index is an encrypted hash value of the searchable field. receiving a plurality of sensitive data records comprising personal information of different users; identifying one or more searchable fields for the sensitive data records, wherein each searchable field is associated with a subset of the personal information for a user; generating (403, 503, 507, 509) a searchable field index for each of the one or more searchable fields; and encrypting the sensitive data records using a database encryption key, the data encryption computer characterised in that the searchable field index for each of the one or more searchable fields is generated (403, 503, 507, 509) based on a sensitivity level of the searchable field, wherein: when the searchable field corresponds to a non-sensitive level, the searchable field index is a plain text of the searchable field; when the searchable field corresponds to a sensitive level, the searchable field index is a hash value of the searchable field; and when the searchable field corresponds to a highly-sensitive level, the searchable field index is an encrypted hash value of the searchable field. when the searchable field corresponds to a non-sensitive level, the searchable field index is a plain text of the searchable field; when the searchable field corresponds to a sensitive level, the searchable field index is a hash value of the searchable field; and when the searchable field corresponds to a highly-sensitive level, the searchable field index is an encrypted hash value of the searchable field.