SQL Server 2008: how do I hide data from a DB Maintainance User? Our organisation employs a third party company to do maintenance on our database. To be honest, currently they act as our DBA's since we do not have one.  

In order to do the maintenance work, they are using the SA user.

Is there a way to make them a new user they can use, to do all of the administrative operations without being to actually see the data. So, they can see all the tables and columns, but they will be unable to see any row.

If I'm missing something, please feel free to enlighten me since my DBA knowledge is fairly poor.
Sysadmins can see all the data in the instance and there is no way to restrict the permissions of members of the sysadmin server role. 

The only possible way to hide data from sysadmins is by encrypting it, using a key that is not available on the server. This is exactly what the Always Encrypted feature in SQL Server 2016 does. 

In SQL Server 2008 your options are very limited: you can use a custom encryption layer, but you would have to code it yourself. Also, unlike what happens in Always Encrypted, there would be nothing to enforce that the columns you want to encrypt actually contain only encrypted data (the application has to take care of that).

That said, this is not only a tech issue: the company that does maintenance for you is a trusted partner, so you can talk to them straight and ask not to look at the data. You can also set up auditing to catch unauthorized reads/writes. However, it's a grey area: if they're troubleshooting a performance issue, for instance, they will probably run some queries and see some data. 

Bottom line is: if you don't trust a third party, don't let them manage your instances.