Scripting

Is anyone storing PII info in KACE?  If so, how can you justify?  Since there is no specific auditing and security controls present challenges Ive just been advised I need to remove all PII information from our employee onboarding process.  Im not sure how I could go about making a business case that the data could be secured.  for example: we use direct sql DB access for scripting outside of kace and there are no controls for which queue's can be accessed.  Not to mention, there is simply no reasonable method that I know of to audit queue access.