A new regulatory requirement imposes severe fines for data leakage involving customers' personally identifiable information (PII). The risk practitioner has rec...