What I find works best is to avoid logging raw datatypes and instead limit it to objects/structs with custom toString. Then just make sure any PII fields are not included with toString either through some sort of annotation or by writing the implementation manually. This also encourages minimizing the code that actually interacts with PII such as replacing emails with user IDs ASAP.