Check with your client/boss if you need to meet any level of requirements for encryption with sensitive data. There are certain levels of encryption that do not meet privacy compliance requirements. You will need to know if you are subject to these.
Otherwise, there is
this article[
^] which should get you started.
Cheers.