• TDE encrypts the data at rest, on disk, and the backups. There is CPU overhead for this.

    Encrypting the data, so that a DBA or unauthorized user who accesses the database, but doesn't have the decryption routine, is another story. That can seriously impact performance, and you should understand the implications before you do this.

    If you just want encrypted backups, there are numerous third party tools to do this. This isn't done natively without TDE.

    NOTE that whichever method you choose, you better understand how to decrypt things if you server explodes. In TDE you need to back up some keys, with third parties, you need to be sure you have copies of the passphrases.