*   Securely delete PII when there is no longer a business need for its retention on the device
*   Do not cache sensitive data
*   Minimize the frequency of asking for user credentials.
*   Minimize the use of APIs that access sensitive or personal user data
*   Consider a logical way to hash the user data
*   Some jurisdictions may require you to provide a privacy policy for accessing personal information.