Now what do I consider to use as the key to encrypt and decrypt the personal data. Can I use the employee's password itself as the key? Would this be sufficient, or should I consider using something else, such as a random set of characters? What would be better? Also help would be appreciated if there is advice regarding managing the encryption keys.
The application resides on a private IP address, and also has the protection of a firewall.