Remember there is also the need to comply with the Data Protection rules, even things as mundane as a name and address. Any holder of such data has a legal obligation to look after that data. The new General Data Protection Regulations are a step up from the previous generation, and more stringent over accountability etc.
A riveting read for those interested.