Encrypt first
Once your data is out of your network, it's not your data anymore.
I use a pre-Dropbox system - anything I want to hold off-site gets dropped into a holding folder, which a task picks up and encrypts the file using 7-Zip (AES-256, and with filename encryption enabled). The task then puts the resulting .7z file into the Dropbox sync folder for uploading to Dropbox.
Obviously, this isn't suitable for mass sharing. But for off-site storage whilst keeping my data private, I think it works a treat and means that if anyone wants to pry, they're going to have to ask me first.
Biting the hand that feeds IT
