Are there any considerations I should have in mind when I patch or upgrade a TDE encrypted database? In the context of separation of duties, does the person executing the patch or upgrade process need access to the Keys or certificates of a TDE encrypted database or can the database be patched without the keys. The answer is important because we are a legal shop and would like an application administrator to encrypt the database and outsource the db maintenance functions to a dba to patch and upgrade the database without having access to the “application data”. Could you throw some light on this please?