Encrypting everything (not at rest) doesn’t really make sense, as if attacker gains RCE, then you have lost, and it is irrelevant to the fact that you have or have not encrypted everything. And encrypting everything mean that you cannot do queries against such DB without decrypting data, which mean that each query need to have access to decryption key, which makes whole encryption moot.
The good approach there would be to not store information that you 100% need. From my experience a lot of services do not need DoB or physical address at all.
