It applies to anything that contains PII, so sure you should ensure your queries are not sent in plaintext over the network and are not logged unnecessarily. There isn't much else that can be done.

It is perhaps a bit too abstract, but that's because it's covering a highly complex topic, but I don't think it's too vague on this: If it contains PII, protect it. Which, of course, you should be doing already.