Although PII is dealt with in GDPR, GDPR doesn't only cover PII, and it makes numerous references to the obligation on anybody who processes personal data (not

Although PII is dealt with in GDPR, GDPR doesn't only cover PII, and it makes numerous references to the obligation on anybody who processes personal data (not just PII) with respect to security. For example "Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing."