With rapidly changing restrictions and guidelines, security leaders have to be careful when protecting personally identifiable information.