Lets be honest here, this is a business risk which is crazy high. As stupid as this is, I care but i can't guarantee it.
I might suggest a construct like this too.
What do you think how much it cost to do it perfect?
But it does create an incentive to not keep data that a company doesn't really need. And that incentive already works with GDPR for PII.
This measure add similar incentive for data breaches.
Perfect isn’t required. The bar is “gross negligence”. Perfect is impossible, but proper compliance procedures, proper process, and a commitment to following industry best practice will always see you on the right side of the negligence bar, even if something slipped through the net.
It’s the difference between being a professional and an amateur (or worse, a ‘cowboy’).