It’s been a while since I’m doing both actually. Since GDPR I tend to encrypt all not searchable data (address, sometimes even names) in an encrypted JSON, inc

It’s been a while since I’m doing both actually. Since GDPR I tend to encrypt all not searchable data (address, sometimes even names) in an encrypted JSON, including the password hash. Someone accessing my database will just have an integer ID, a hashed login and an encrypted field. Not sure if it’s enough, but it seems ok to me.