Pardon me from being silly here bit isnt it the DBA who will encrypt the data in the first place and would also know how to decrypt it.



Quote Originally Posted by jmodic
They probably don't. But it is trivial to deny access to the confidential paper docs to anyone who is not authorized to see them, no?

They can't deny access to the confidential data in the database from DBAs, so the only option is to make those confidential data "readable" for the authorized database users only. And data encription is the way to go in such situation. Only the authorized users will have the access to the encription keys, regardless of wether they are DBAs or not.