---
schema_version: "1"
id: 324482b200402212c93807c384edd77068cc41af9600d762e1d9a7982a3c4808
title: Automatic Re-Encryption of Data
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ind/264-0-0/admin_encryption_rotation.md
canonical_url: https://help.salesforce.com/s/articleView?id=ind.admin_encryption_rotation.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 08741228f36d10873e980b8bb0af5f99c64e02bcbe8e1ae6af4477f373a69ba2
description: If you enable automatic key rotation for your AWS Key Management Service (KMS) key, AWS rotates the root key material annually. During the root key rotation, the system rotates your data key, which is used to encrypt and re-encrypt the data.
products:
  - Industry Solutions
  - Cross Cloud
release: "264"
---
# Automatic Re-Encryption of Data

If you enable automatic key rotation for your AWS Key Management Service (KMS) key, AWS rotates the root key material annually. During the root key rotation, the system rotates your data key, which is used to encrypt and re-encrypt the data.

If you use an alias Amazon Resource Name (ARN) to encrypt your data, Einstein automatically re-encrypts the data during the annual key rotation. If you encrypt your data by using an AWS KMS ARN, and not an alias ARN, manually reconfigure the new key every year.

When you re-encrypt your data automatically by using the same AWS KMS key, the system uses an existing unchanged root key and the automatically rotated data keys to re-encrypt the data.

#### See Also

- [Rotating AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)