I don't have direct experience to answer your question, but I think perhaps audits are part of the answer. Really, you can go a long way by asking "who has acc

I don't have direct experience to answer your question, but I think perhaps audits are part of the answer. Really, you can go a long way by asking "who has access to the system storing the data", "what is the policy for granting and revoking that access", "what are the policies for handling the data (to avoid leaking it)"? I've worked at big tech companies but never come across a customer credit card number because there are policies for handling that data and audits to make sure they are obeyed. I think basic checks will go a long way. (Granted, you're talking about a situation in which a company would have an incentive to subvert the controls on data; that's not really the case for credit card data.)