If they are using extra-judicial means to get at the data I have no recourse anyways. I will have to store it somewhere and a dedicated attacker will always (e

If they are using extra-judicial means to get at the data I have no recourse anyways. I will have to store it somewhere and a dedicated attacker will always (eventually) find a vulnerability. The standards I have to implement do not state that I must keep the data out of the hands of attackers. They state principles and methods that make it less likely. When the regulators come knocking after an 'incident' their levying of fines will depend on standards and regulation compliance, not the leaked documents. You have an unreasonable expectation of what can be done.