It does exist in the medical world with laws and regulations. For example you can follow the standard IEC 81001-5-1 to tell you what to do. It’s not perfect but

It does exist in the medical world with laws and regulations. For example you can follow the standard IEC 81001-5-1 to tell you what to do. It’s not perfect but it’s a good start and people generally agree that it’s good to implement. My own solution would be to stop the proliferation of web sites as a disservice, and focus again on keeping private data private, i.e. on the client’s computer. If you don’t have it, you can’t leak it.