Indeed. We store data encrypted because it A) leaves no room for misunderstanding with different regulators or their respective auditors, and B) provides a c

Indeed. We store data encrypted because it A) leaves no room for misunderstanding with different regulators or their respective auditors, and B) provides a computationally infeasible barrier against accidental personal information disclosure even if the storage system was improperly decommissioned Point B in particular can be explained to auditors without problems. They understand both the intent and the technical measures put in place. But how we store data is only tangentially relevant to how we handle data. Let alone what we need to collect in the first place. (The KYC/AML/SOW requirements in gambling are quite demanding; they impose significant data collection and retention needs.)