A computer-implemented method, comprising: receiving at a storage system, from a host requestor at a host, a request to access data (110,108), wherein the data comprises: legacy data that is stored in a storage unit, wherein the legacy data is pre-existing data, wherein the legacy data is maintained in the storage unit in an unencrypted state at least until the time an attempt is made to access the legacy data; and non legacy data stored in the storage unit in an encrypted state; determining, at the storage system, whether the requestor is authorized to access the data; determining, at the storage system, whether the data is encrypted, in response to determining that the requestor is authorized to access the data; requesting, by the storage system, an encryption key from the requestor, in response to determining that the data is not encrypted; receiving, at the storage system, the encryption key from the requestor encrypting, at the storage system, the data by using the encryption key; migrating all legacy data, at the storage system, stored in the storage unit to encrypted data stored in the storage unit, over an extended period of time; and allowing the requestor to access the data. receiving at a storage system, from a host requestor at a host, a request to access data (110,108), wherein the data comprises: legacy data that is stored in a storage unit, wherein the legacy data is pre-existing data, wherein the legacy data is maintained in the storage unit in an unencrypted state at least until the time an attempt is made to access the legacy data; and non legacy data stored in the storage unit in an encrypted state; determining, at the storage system, whether the requestor is authorized to access the data; determining, at the storage system, whether the data is encrypted, in response to determining that the requestor is authorized to access the data; requesting, by the storage system, an encryption key from the requestor, in response to determining that the data is not encrypted; receiving, at the storage system, the encryption key from the requestor encrypting, at the storage system, the data by using the encryption key; migrating all legacy data, at the storage system, stored in the storage unit to encrypted data stored in the storage unit, over an extended period of time; and allowing the requestor to access the data. legacy data that is stored in a storage unit, wherein the legacy data is pre-existing data, wherein the legacy data is maintained in the storage unit in an unencrypted state at least until the time an attempt is made to access the legacy data; and non legacy data stored in the storage unit in an encrypted state; determining, at the storage system, whether the requestor is authorized to access the data; determining, at the storage system, whether the data is encrypted, in response to determining that the requestor is authorized to access the data; requesting, by the storage system, an encryption key from the requestor, in response to determining that the data is not encrypted; receiving, at the storage system, the encryption key from the requestor encrypting, at the storage system, the data by using the encryption key; migrating all legacy data, at the storage system, stored in the storage unit to encrypted data stored in the storage unit, over an extended period of time; and allowing the requestor to access the data.