The collection and use of Personally Identifiable Information (PII) is exploding. With this expansion, there is increasing pressure from individuals, industry regulators, and lawmakers for organizations to protect sensitive data from hacker attacks and insider abuse or theft. The six steps outlined in this paper illustrate the challenges around the protection of sensitive data and how a Database Auditing and Protection solution, like Imperva SecureSphere, can be used to safeguard PII and comply with industry regulations and data privacy laws.