Periodically re-encrypting user data stored on a storage device, including: determining that data stored in a first location of a storage device is encrypted with a data encryption key that has been decommissioned; re-encrypting the data utilizing a current data encryption key; and writing the data that is encrypted utilizing the current data encryption key to a second location of the storage device.