I use multiple protection methods, mainly focusing on defending my stuff against a physical theft.
1: BitLocker with a TPM if available is what I use to keep the data away from the meth-heads if the machine is stolen. On the Mac, I use FileVault.
2: For backups, on Windows, I copy files to a BitLocker protected external drive. On Macs, I use Time Machine, as well as a utility that uses zbackup to copy all documents to a backup repository.
3: For virtual machines that are sensitive, I just click the "encrypt" button in the VM program, set a password, call it done.
4: For client data that is sensitive, and only accessed rarely, it goes into a VeraCrypt volume, and is protected with a cryptographic token. That way, even if someone pulls the decryption keys out of RAM, the stuff I am obligated to keep secure stays locked out of reach out of bad guys.
5: For cloud backups, I use Boxcryptor. This way, if a cloud account gets compromised, all files are protected.