3498202 - Enabling or Disabling HANA Encryption Fails With Error: SYSTEMDB does not have control to modify the encryption state of the tenant database

You are trying to enable or disable HANA persistence, log, or backup encryption following Enable Encryption | SAP Help Portal and Disable Encryption | SAP Help Portal. However, it fails with errors below:

SAP DBTech JDBC: [403]: internal error: SYSTEMDB does not have control to modify the encryption state of the tenant database: <tenant SID>
or
SAP DBTech JDBC: [403]: internal error: Encryption config control is not granted to local database

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.     

SAP HANA Platform Edition 2.0 SPS03 and above

Encryption Configuration Control, encryption_config_control, database_initial_encryption, local_database, system_database , KBA , HAN-DB-SEC , SAP HANA Security & User Management , Problem