Alasjo already provided a good answer, but I think some additional information could help you grasp the difficulties you have and how to address them.
In you question you suggested encryption. Just encrypting the uploaded data cannot be enough to secure them. Since encrypted data is useless without a mean to decrypt them, your application would have to provide a way to decrypt them. If your attacker is able to impersonate an user with rights to access the data, he could let your application decrypt it for him. This issue is even greater if everybody logged into your system can access the uploaded data.
What you really need is a good authentication process combined with good authorization (AKA rights management):
1) Authentication is to ensure that nobody is usurping the identity of a legitimate user. You can start by ensuring that your user are using difficult to guess passwords (e.g. by using zxcvbn) and NOT requiring them to change it regularly (the drawbacks are far greater then the benefits). Then you should follow OWASP's guide on authentication.
2) Authorization is to ensure that the user can only access the data they have rights to. There are many ways to define and check rights, and you should take care to separate those to concepts. Usually the RBAC model is followed, but your application might require a finer control, so choose wisely. RBAC consists in putting user in groups (or roles) and giving rights to the groups (and not to the users). In your case you might allow only the uploader and the recipient of the uploaded data to access it. The recipient can implicitly be a group. OWASP has a checklist on authorization too.
You can encrypt the uploaded data, but do not expect to gain a significant increase in security from it. Explaining how to do it properly would necessitate another answer or guide. But of course, the upload and download processes themselves must be protected using TLS.
Do not forget to follow the advices provided by Alasjo in his answer too.