Where deduplication and encryption happens

Hi Community,

I want to know where deduplication happens in a Global deduplication storage policy?

Client side or Media agent side or both?

if both, then if the encryption is enabled how it dedupes? i know that the encryption happens in a way Compress > Dedupe > Encrypt .

If the encryption enable in agent side, the agent do Compress > Dedupe > Encrypt and send data to media agent. does the media agent decrypts data to dedup again or send the data as it is to Disk lib?