White Paper: What Data Needs Encrypted in MongoDB?
Generally speaking, you should encrypt any information that alone, or when combined with other information, can identify a unique, individual person. This is called Personally Identifying Information, or PII.