This is a fairly standard approach to solving that issue. There are even some applications built for the purpose of housing that data, encrypting it, maintainin

This is a fairly standard approach to solving that issue. There are even some applications built for the purpose of housing that data, encrypting it, maintaining audit and use records, processing DSARs, and interacting with the data in useful ways via API.