Basic Privacy Protection 101.
Chapter 1.
Never, ever store the personal data in the same place as the person’s name.
Store the data using a numeric ID tag,and the actual name in another database, heavily encrypted, that links the name to the ID tag. The two files are not in the same database, not even in the same place (server farm). It takes two different access methods to connect the data to the name, and can only be done on the destination computer.
Let’s just say, the one I’ve worked at had it’s own team but someone once upon a day wanted to chop that and buy proprietary software…… then personally tweak it for use so it’s not even updated with the purchased software.
All the while half or more staff still struggle with Google Suite and general technology across ages.
Sounds like the board I worked for. They insisted on using FORD systems - Fix Or Repair Daily.