1. A data storage system comprising: a computing system comprising one or more hardware processors programmed to: detect a file interaction event with respect to a file on a storage device; responsive to detecting the file interaction event with respect to the file, access an encryption rule, the encryption rule including a set of rules for determining whether to encrypt files based on a set of context conditions, the set of context conditions including a geographic context; determine a set of data tokens for the file, each of the data tokens comprising a portion of content of the file; apply the encryption rule to the set of data tokens to determine whether the file includes content designated for protection, wherein application of the encryption rule includes: determining whether one or more data tokens from the set of data tokens satisfy the encryption rule; and ceasing said determining whether the one or more data tokens from the set of data tokens satisfy the encryption rule upon identification of a threshold number of data tokens satisfying the encryption rule regardless of whether each data token from the set of data tokens has been processed to determine whether it satisfies the encryption rule; responsive to determining that the file includes content designated for protection: determine a geographic location of the storage device; determine whether the geographic location of the storage device satisfies the geographic context for encrypting the file; and responsive to the geographic location of the storage device satisfying the geographic context, encrypting the file; and responsive to an indication that the file does not include content designated for protection: include the file with a set of training files used to generate one or more encryption rules; and modify the encryption rule based at least in part on the set of training files and the file.