Encryption remains one of the most important foundations of PII protection. However, as organizations increasingly analyze, share, and use sensitive data, encryption alone does not address the challenge of protecting data while it is actively being processed.
In reality, encryption only protects sensitive data until someone needs to use it.
Every time personally identifiable information (PII) is queried, shared with a business partner, analyzed by an AI model, or processed by an application, it typically has to be decrypted first.
That transition from encrypted data to usable data creates a critical protection gap: data becomes vulnerable precisely when organizations need to extract value from it.
For regulated industries, the stakes couldn’t be higher. Financial institutions, healthcare providers, insurers, and government agencies rely on PII data to operate, yet every system, employee, vendor, and AI tool that touches that data expands the attack surface.
A single exposure can lead to regulatory investigations, multimillion-dollar fines, operational disruption, and long-term reputational damage.
Effective PII protection is no longer just about encrypting databases or checking compliance boxes. It requires protecting personally identifiable information throughout its entire lifecycle, including while it’s actively being processed, analyzed, and used to power AI.
In this guide, you’ll learn what modern PII data protection actually looks like, where organizations most often fall short with GDPR, HIPAA, and CCPA compliance, why encryption alone is no longer enough, and how privacy-enhancing technologies allow organizations to analyze and share sensitive data without exposing it.
Quick Take:
-
- Encryption protects PII at rest and in transit, but leaves it exposed the moment it is processed, which is exactly when most breaches and AI related leaks happen.
- GDPR, HIPAA, and CCPA all define and enforce PII protection differently, so a single compliance checklist rarely covers all three at once.
- Privacy enhancing technologies like fully homomorphic encryption and secure multi party computation let organizations analyze PII without ever decrypting it, closing the gap traditional security leaves open.
- AI and LLM workflows have become a significant source of PII exposure, with shadow AI adding an average of $670,000 to breach costs.
What Are the Most Effective Strategies for Protecting PII in Regulated Industries?
Every regulated industry, from banking to healthcare to government, faces the same core challenge. Sensitive data has to be usable and protected at the same time. The organizations that manage this well are not relying on one tool. They layer several protections so that if one fails, the next one holds.
Encryption at rest and in transit is the baseline. It is not optional, but it is only the starting point.
Role based access control limits who can even see PII in the first place, so a customer support agent and a finance director are not working from the same permission set.
Data minimization means collecting and retaining only the PII you actually need. If a field has not been required for the last three audits, it is a liability sitting in your database.
Continuous monitoring and anomaly detection catch the moment someone accesses PII outside a normal pattern, such as a bulk export at 3am from an account that has never done that before.
Employee training closes the gap technology cannot. Human error remains one of the leading causes of breaches, which means a well trained team matters as much as any single security tool.
Did you know?
Data breaches involving multiple environments, such as a mix of public cloud, private cloud, and on premises systems, cost an average of 5.05 million dollars, the highest of any breach category tracked in IBM’s 2025 report.
None of these layers replace the others. A company with perfect access controls but no encryption is still exposed. A company with strong encryption but no monitoring will not notice a breach until it is too late. The strategies work because they overlap.
However, these traditional controls primarily protect PII before it is used or after it has been stored. The remaining challenge is protecting sensitive information while it is actively being processed, whether for analytics, AI model training, fraud detection, or collaboration with external partners.
That “data in use” stage is where conventional security measures reach their limits and where privacy-enhancing technologies become essential.
These layers cover data at rest and in transit well. The next question is where PII actually leaks in practice, and that often has less to do with stolen laptops than with gaps in how regulations get interpreted day to day.
What Do GDPR, HIPAA, and CCPA Require for PII Protection and Where Do Organizations Most Often Fall Short?
Regulated industries rarely deal with just one privacy law. A healthcare company with California patients and European research partners can find itself accountable to HIPAA, CCPA, and GDPR at the same time, and each one defines and enforces PII protection differently.
| Regulation | What It Covers | Where Organizations Typically Fall Short |
|---|---|---|
| GDPR (EU) | Any data that can identify an EU resident, directly or indirectly | Fines up to 4 percent of global annual revenue or 20 million euros, whichever is higher. Most gaps trace back to unclear legal grounds for processing and slow responses to data subject requests. |
| HIPAA (US) | Protected health information held by covered entities and business associates | Civil penalties up to 1.5 million dollars per violation category per year. OCR’s 2025 enforcement actions centered almost entirely on missing or outdated risk analyses, not the breaches themselves. |
| CCPA/CPRA (California) | Personal information of California residents, with broader scope after CPRA amendments | Fines from 2,663 to 7,988 dollars per violation. California regulators fined Disney 2.75 million dollars in early 2026, the largest CCPA settlement to date, over opt-out mechanisms that looked compliant on paper but failed in practice. |
The pattern across all three regulators is consistent. It is rarely the initial mistake that turns into a major penalty.
It is the absence of documentation proving the organization tried. HHS settled with a business associate in 2026 after a breach exposed the protected health information of fifteen million people, and the resolution centered on a missing risk analysis rather than the breach itself.
The same logic applies wherever PII changes hands between systems, vendors, or departments.
Meeting these requirements on paper is one thing. Meeting them in practice depends on what happens the moment PII actually gets used, and that is where most compliance programs are weakest.
Why Is Encryption Alone Not Enough to Protect PII in Modern Enterprise Environments?
Sensitive data exists in three states: at rest, in transit, and in use. Encryption is excellent at protecting the first two.
A database sitting on a server is encrypted. A file moving across a network is encrypted. But the moment that data needs to be read, queried, or analyzed, it typically has to be decrypted first, and that decrypted moment is exactly when most breaches, insider incidents, and AI data leaks actually happen.
Think of it like a bank vault. The vault is excellent at protecting cash while it sits untouched. But the moment a teller opens it to count that cash, the money sits exposed on the counter. Traditional encryption protects the vault. It does nothing for the counting.
This is why compliance checklists that only ask whether your data is encrypted miss the real risk. A database can be fully encrypted at rest, pass every audit, and still leak PII the moment an analyst runs a query, a machine learning model trains on it, or a support tool surfaces a customer record on screen.
Encrypting data at rest is an important compliance requirement, but it does not address the challenge of protecting information while it is actively processed.
This is the exact gap privacy enhancing technologies were built to close.
How Do Privacy-Enhancing Technologies Provide Stronger PII Protection Than Traditional Security Measures?
Privacy enhancing technologies, often shortened to PETs, are a category of tools built specifically to protect data while it is being used, not just while it sits still or moves between systems.
- Fully homomorphic encryption allows a computer to perform calculations directly on encrypted data and produce an encrypted result that, once decrypted, matches what you would have gotten by running the same calculation on the original plain data.
The data itself is never exposed during the computation. Compared with traditional data masking, this approach keeps the full dataset intact for accurate analysis instead of trading away data quality for privacy. - Secure multi party computation lets two or more organizations run a joint calculation on their combined data without either party seeing the other’s raw inputs. A bank and an insurer can check for overlapping fraud patterns without either one handing over a customer list.
Federated learning trains a machine learning model across multiple decentralized datasets without the data ever leaving its original location. Only model updates move between parties, never the raw data itself.
Trusted execution environments use dedicated, isolated hardware inside a processor to run computations in a sealed off space that even a system administrator cannot inspect.
None of these approaches replace encryption at rest or access controls. They add a layer that protects the one state those tools cannot touch: data in use.
For regulated industries handling PII across departments, subsidiaries, or external partners, that layer is often the difference between an architecture that is compliant and one that only looks compliant until someone runs a query.
How Do Organizations Protect PII When Using AI and Large Language Models?
AI has become one of the fastest growing sources of PII exposure, and it rarely happens the way people expect.
It is usually not a hacker breaking in. It is an employee pasting a customer record into a public chatbot to save time, or a model quietly memorizing training data it should never have touched.
IBM’s 2025 report found that shadow AI, meaning AI tools employees adopt without security oversight, was involved in 20 percent of breaches and added an average of 670,000 dollars to the total cost.
Among organizations that experienced an AI related breach, 97 percent had no proper access controls on their AI systems at all.
The challenge is not only preventing sensitive data from entering AI systems. Organizations also need ways to safely use sensitive data to train, fine-tune, and improve AI models without moving or exposing it.
A few practices meaningfully reduce this risk.
- Input scrubbing and PII masking happen before any data reaches a model, using named entity recognition to detect and redact names, medical record numbers, and account details before they reach a prompt.
- Access controls and governance policies built specifically for AI tools matter, not just general IT policy, since most organizations still treat AI as an afterthought in their security program.
- Privacy preserving inference, using techniques like fully homomorphic encryption and secure enclaves, lets a model process encrypted inputs and return encrypted outputs, so the model itself never sees the underlying PII in plain form.
- Federated fine tuning lets a model improve using data from multiple sources without pooling that data in one place first.
None of these controls is a silver bullet on its own. Together, they are what separates an AI program that scales safely from one that becomes the next compliance incident.
Our guide to LLM data privacy walks through where models leak sensitive data across the full pipeline, from training to fine tuning to serving.
How Can Organizations Share and Analyze PII-Sensitive Data Without Exposing It to External Parties?
Regulated industries increasingly need to work with data they do not own. A hospital network wants to compare patient outcomes with a research partner.
A bank wants to screen transactions against a government watchlist. A marketer wants to measure campaign performance using a partner’s customer list. In every case, the PII involved cannot legally or practically change hands.
This is exactly the problem Duality Technologies was built to solve. Duality’s platform uses fully homomorphic encryption, federated learning, and secure multi party computation to let organizations run real analysis, AI training, and SQL like queries across sensitive, siloed, or third party datasets, all without ever exposing the underlying PII to anyone outside its owner.
Duality Query gets you answers from data you do not have direct access to. Collaborative AI lets you train and license models on sensitive data without relying on trust or contracts alone, because the encryption itself enforces the boundary.
For compliance and security teams, that means PII protection stops being a blocker to collaboration and becomes something you can prove, not just promise, to regulators, partners, and auditors.
PII protection has moved well past encrypting data and locking it down. Regulated industries now need layered defenses, a clear read on what GDPR, HIPAA, and CCPA each actually require, and a plan for the moment data gets decrypted, whether that is a routine query or an AI model in training.
The organizations getting this right are not choosing between usability and protection. They are using privacy enhancing technologies to get both, so PII can be analyzed, shared, and put to work without ever being exposed in the process.
If your PII protection strategy still ends at encrypted at rest, it might be time to look at what happens the moment that data gets used.
