This is just called actually understanding your threat model and fully evaluating the controls available to you. Basic information security.

The most secure password policy in the world doesn’t matter if your users just write them down on sticky notes on their desks. Security on your end doesn’t matter if you’re sending the data to an insecure destination.

Same concepts apply to privacy.