1. A method implemented in a computing device, the method comprising: detecting whether a file on the computing device, created prior to implementation of a data protection policy, has been written to by a first program; adding, based at least on detecting that the file has been written to by the first program, an identifier of the file to a file encryption queue; determining whether any programs on the computing device are currently accessing the file; and encrypting the file based at least on determining that no programs on the computing device are currently accessing the file.