A data encryption computer, comprising: a processor; and a non-transitory computer-readable storage medium (1001, 1007), comprising code executable by the processor for implementing a method comprising: receiving a plurality of data records; identifying one or more searchable fields for the data records; generating (403, 503, 507, 509) a searchable field index for each of the one or more searchable fields; and encrypting the data records using a database encryption key, the data encryption computer characterised in that the searchable field index for each of the one or more searchable fields is generated (403, 503, 507, 509) based on a sensitivity level of the searchable field, wherein: when the searchable field corresponds to a non-sensitive level, the searchable field index is a plain text of the searchable field; when the searchable field corresponds to a sensitive level, the searchable field index is a hash value of the searchable field; and when the searchable field corresponds to a highly-sensitive level, the searchable field index is an encrypted hash value of the searchable field. a processor; and a non-transitory computer-readable storage medium (1001, 1007), comprising code executable by the processor for implementing a method comprising: receiving a plurality of data records; identifying one or more searchable fields for the data records; generating (403, 503, 507, 509) a searchable field index for each of the one or more searchable fields; and encrypting the data records using a database encryption key, the data encryption computer characterised in that the searchable field index for each of the one or more searchable fields is generated (403, 503, 507, 509) based on a sensitivity level of the searchable field, wherein: when the searchable field corresponds to a non-sensitive level, the searchable field index is a plain text of the searchable field; when the searchable field corresponds to a sensitive level, the searchable field index is a hash value of the searchable field; and when the searchable field corresponds to a highly-sensitive level, the searchable field index is an encrypted hash value of the searchable field. receiving a plurality of data records; identifying one or more searchable fields for the data records; generating (403, 503, 507, 509) a searchable field index for each of the one or more searchable fields; and encrypting the data records using a database encryption key, the data encryption computer characterised in that the searchable field index for each of the one or more searchable fields is generated (403, 503, 507, 509) based on a sensitivity level of the searchable field, wherein: when the searchable field corresponds to a non-sensitive level, the searchable field index is a plain text of the searchable field; when the searchable field corresponds to a sensitive level, the searchable field index is a hash value of the searchable field; and when the searchable field corresponds to a highly-sensitive level, the searchable field index is an encrypted hash value of the searchable field. when the searchable field corresponds to a non-sensitive level, the searchable field index is a plain text of the searchable field; when the searchable field corresponds to a sensitive level, the searchable field index is a hash value of the searchable field; and when the searchable field corresponds to a highly-sensitive level, the searchable field index is an encrypted hash value of the searchable field.