There are government agencies that can give you a smack down for mishandling PII even if you're not hacked. They do do audits now and then although from what I've heard they are a little stone age in their methods and might not catch on if you're doing something shady unless it's obvious.