Two measures (as far as I know) are available for secure data backup with Bacula. One is for communication channel security using TLS across Bacula entities like storage daemon, file daemon, bconsole, director, and so on because Bacula spans multiple hosts over the net. The other is back(ed) up date set encryption with PKI.
Let me share how I figured out TLS configuration with certificates from CAcert.org. This configuration can go for any sections (Storage, Director, FileDaemon, …) asking you set TLS glue.
FileDaemon { # this is me
Name = some_name
FDport = 9102
WorkingDirectory = /var/spool/bacula
Pid Directory = /var/run
Maximum Concurrent Jobs = 3
TLS Enable = yes
TLS Require = yes
# TLS Verify Peer = yes
TLS Certificate = location_to_cert_file_you_got_from_cacert
TLS Key = location_to_private_key_you_generated_yourself
TLS CA Certificate File = location_to_root_cert_file_you_got_from_cacert
PKI Signatures = Yes # Enable Data Signing
PKI Encryption = Yes # Enable Data Encryption
PKI Keypair = blah_blah.pem # Public and Private Keys
PKI Master Key = blah_blah_master.cert # ONLY the Public Key
}