PII Protection: Building Awareness beyond Compliance

Published: November 3, 2025

In today’s digital landscape, organizations across all sectors—financial services, healthcare, government, education, and non-profits—are grappling with the challenge of protecting Personally Identifiable Information (PII). With increasing regulatory scrutiny and the rising threat of data breaches, fostering a culture of PII protection is not just a compliance issue; it’s a critical business imperative.

In our previous blog ‘Why Redaction Matters, even for Archived Documents’ we outlined best practices for the challenges all organisations are facing on protecting PII information.

In this blog we explore strategies for embedding privacy awareness into daily operations, training staff, and leveraging technology to minimize human error.

The Importance of PII Protection

Statistics Highlighting the Need for PII Protection:

In 2023, the financial sector accounted for 27% of all data breaches, making it the most breached industry.

In 2023, 55% of healthcare organizations globally experienced an accidental or deliberate data leak from internal sources. Healthcare was the most breached sector in 2024, accounting for 23% of all data breaches. Healthcare records are extremely valuable to cybercriminals and can be used for many malicious purposes. On average, hackers are able to earn around $1,000 for each set of stolen healthcare records.

80% of companies in the US and 85% of companies in Asia, Europe, Africa, and Latin America say they’ve been successfully hacked in an attempt to steal, change, or make public important data.

In 2025 the average cost of a data breach incident across companies worldwide is 4.44 million U.S. dollars.

These statistics underscore the urgent need for organizations to prioritize PII protection, not only to comply with regulations but also to safeguard their reputation and maintain customer trust.

Regulatory Landscape

Organizations around the world are governed by comprehensive privacy frameworks designed to protect personal information.

Europe

The European Union has established one of the most comprehensive data protection frameworks globally through the General Data Protection Regulation (GDPR).

General Data Protection Regulation (GDPR): Enacted in 2018, the GDPR applies to any organization processing the personal data of EU residents, regardless of the organization's location. Key principles include lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.
Rights of Data Subjects: The GDPR grants individuals several rights, including the right to access, rectification, erasure (the "right to be forgotten"), data portability, and the right to object to processing.
Enforcement and Penalties: Non-compliance can result in fines of up to €20 million or 4% of the organization’s global annual revenue, whichever is higher. The GDPR has led to significant enforcement actions.

United States

The U.S. lacks a comprehensive federal law governing PII protection, resulting in several sector-specific regulations and state-level privacy laws.

Federal Trade Commission Act (FTC Act): This act empowers the FTC to enforce against unfair or deceptive practices, including those related to privacy and data security. Organizations can be penalized for failing to implement reasonable data security measures or for misleading privacy statements.
Health Insurance Portability and Accountability Act (HIPAA): HIPAA sets national standards for the protection of health information, requiring healthcare providers and their business associates to safeguard sensitive patient data.
California Consumer Privacy Act (CCPA): Enacted in 2018, the CCPA grants California residents rights to access, delete, and opt out of the sale of their personal information. The California Privacy Rights Act (CPRA), effective January 1, 2023, expands these rights and establishes the California Privacy Protection Agency (CPPA) for enforcement.
Virginia Consumer Data Protection Act (CDPA): Effective in 2023, the CDPA provides Virginia residents with rights similar to those in California, including access, correction, deletion, and opt-out rights for targeted advertising and data sales.
Colorado Privacy Act (CPA): Also effective in 2023, the CPA applies to businesses handling data of 100,000 or more Colorado residents and provides rights to access, correct, delete, and opt out of certain data processing activities.

Singapore

Singapore's Personal Data Protection Act (PDPA) establishes a framework for data protection in the private sector.

Personal Data Protection Act (PDPA): Enacted in 2012, the PDPA governs the collection, use, and disclosure of personal data by private sector organizations. Key obligations include obtaining consent, purpose limitation, notification, access and correction rights, and data breach notification.
Enforcement Mechanisms: The Personal Data Protection Commission (PDPC) administers and enforces the PDPA, with the authority to investigate complaints and impose penalties. Organizations can face fines of up to SGD 1 million or 10% of their annual turnover in Singapore, whichever is higher.
Recent Developments: In 2024, the PDPC published guidelines emphasizing enhanced protection for children's personal data in the digital environment, reflecting a growing focus on safeguarding vulnerable populations.

Australia

The Privacy Act 1988 applies to federal agencies, private sector organizations with an annual turnover of over $3 million, and some small businesses.
Key requirements include the Australian Privacy Principles (APPs), which mandate the secure handling of personal information and the Notifiable Data Breaches (NDB) scheme, requiring organizations to notify affected individuals of breaches likely to cause serious harm.

New Zealand

The Privacy Act 2020 applies to all agencies, including non-profits and individuals in business.
It mandates mandatory breach notification and requires organizations to appoint a privacy officer responsible for compliance. Understanding these regulations is crucial for organizations to avoid penalties and build trust with customers.

Strategies for Building a Culture of PII Protection

Strategies for building a culture of PII protection

Tailor Training to Organizational Needs
- Training should reflect the specific types of PII handled and the unique risks of each organization. For example, healthcare organizations must address HIPAA compliance, while educational institutions focus on FERPA.
Define and Classify PII
- Employees must understand what constitutes PII, including both direct identifiers (e.g., Social Security Numbers) and indirect identifiers (e.g., IP addresses). Classifying PII by sensitivity helps apply appropriate safeguards.
Implement Role-Based Access Control (RBAC)
- Limit access to PII based on job roles to ensure that employees only access the information necessary for their work. Regularly review and adjust permissions to maintain security.
Ongoing, Engaging Training
- Provide regular training sessions that include simulations and real-world scenarios. Avoid punitive approaches; instead, foster a culture of learning and responsibility.
Incident Response and Reporting
- Train staff on recognizing, reporting, and responding to PII incidents. Regularly practice incident response plans to ensure preparedness.
Leverage Technology Solutions
- Utilize automated PII discovery tools to identify where PII resides across various data environments. Implement Data Loss Prevention (DLP) solutions and encryption to protect PII both at rest and in transit.
- Modern automation platforms like Tungsten TotalAgility offer advanced redaction capabilities that go far beyond manual document review. Leveraging artificial intelligence, TotalAgility automatically detects and redacts sensitive information—such as names, account numbers, and tax file numbers—across both new and archived documents. The platform integrates seamlessly with enterprise content management systems, ensuring that redacted documents are securely handled and all changes are fully auditable. By automating the redaction process and supporting customizable rules, TotalAgility helps organizations consistently protect PII, minimize human error, and meet the stringent requirements of global privacy regulations
Continuous Monitoring and Improvement
- Monitor data repositories and user activity in real-time to detect breaches or policy violations early. Regularly assess training effectiveness and update content to address new threats.

Building a culture of PII protection is essential for organizations across all sectors. By implementing tailored training programs, leveraging technology, and fostering a proactive approach to data protection, organizations can significantly reduce the risk of data breaches and enhance customer trust. As the regulatory landscape continues to evolve, staying informed and prepared is crucial for success.

Take the first step - Book a Demo to see how Automation can help.

by Tom Coppock Senior Director, AI Strategy & Research

PII Protection: Building Awareness beyond Compliance

The Importance of PII Protection

Statistics Highlighting the Need for PII Protection:

Regulatory Landscape

Strategies for Building a Culture of PII Protection

Related resources

Contact us

Request a demo