I’m not sure if it would work for everyone, but we keep all our sensitive data in an entirely separate schema, and everything is to be built to assume the sensi

I’m not sure if it would work for everyone, but we keep all our sensitive data in an entirely separate schema, and everything is to be built to assume the sensitive rows can suddenly not exist at any time. This way we only need to restore the insensitive schema to staging areas, and have different backup policies, keeping the insensitive far longer.