It's also possible to completely automate this. Flow.io has a great talk where the CTO talks about everything they do from an engineering perspective. Just annotate data in your API spec language as PII. This can allow you to also have policies that can be verified by this. If some advice has PII you can enforce that some other service can never talk to it, for example.