Data privacy regulations and industry regulation don’t precisely say “implement encryption at the application level”, but often say “sensitive data should be encrypted”. Using application level encryption simplifies the compliance process. Sensitive data includes PII, PHI, payment data, and any kind of business-essential data.
Check out the “PII encryption requirements. Checklist” and GDPR for software developers: implementing rights and security demands.