I have an out of band answer: simply, I go out of my way to not handle sensitive data if I can at all help it.
Okay, so on the face if it that's not a very helpful response. Let's make it more so. I've learned that a lot of the time when clients come to me and say they need to protect data such-n-such that a careful exploration of their data and goals will reveal that there isn't as much to protect as initially thought. Sometimes the truly private stuff can be separated without too much trouble. You keep that table of birthdays and home address locations over there, in your private file system. I'll keep the geometry over here in the shared workgroup space, and you can join them when needed using this ID column.
The basic principle is: keep the responsibility for managing the security as close to the source, to home, as possible.
This way even though I might manage the spatial data, I actually know next to nothing about it, and thus can never be a vector for it's potential exposure. I think of it as akin to the basic computer security protocol that a sysadmin can reset your password or lock the account, but not actually read it.