This is only a partial answer, and hopefully someone can improve on it.
I can't answer if data is encrypted for Mail and the other built in apps, but each application does get a sandboxed local data store. The weather app you download can't access the saved data from your mail app, and so on.
Now, for 3rd party applications it is up to the developer to encrypted the data should they wish. By default what is put in Isolated Storage (that is what they call the sandboxed data store) is in clear text.
Thankfully, short of some unknown exploit, the only way to get the data would be having it developer unlocked, and also in the hands of the un-trusted person. They could run the Isolated Storage browser or some other homebrew application, and see what is on the phone, and possibly get sensitive data. If you are worried about this there are a few safeguards you can enable:
- Put a PIN on your lock screen. After 3 incorrect tries the phone is restored to factory settings*.
Lock and Wallpaper >
- Enable "Find my Phone". Not only will you be able to see where the phone is, you can send an "erase" signal to it forcing all the data to be wiped.
Find my Phone
I will use this answer as an example as to why you should be careful when installing homebrew applications. The applications you download via the official Marketplace undergo extensive review and certification. They are also limited as to what they can do. For instance, I can not write an application that will take over the default browser on the phone.
However, homebrew applications are not "official", and do not undergo the same process. In a homebrew application I can use what they call "Native Code". Doing so gives me much more flexibility on what I can do, but also put you, the user, at risk. I could secretly be monitoring your email, or sending browsing history back to the cloud. Always be cautious when installing homebrew.
If you don't know what I am talking about, then most likely you don't need to worry about it. Currently, you need to have your phone "developer unlocked" which means you are able to create applications for you phone. You can not get these homebrew applications from the marketplace.
* Only if the phone is synced to an Exchange account. Otherwise it just creates a "timeout", and you must wait to try again