[Bluestrike2]

That doesn't necessarily limit your risk exposure if litigation ensues. Anyone going after you (or the data holding company in particular) is going to attempt to pierce the corporate veil. And while that's not necessarily easy, it's still common enough. In that situation, it's almost inevitable that the separation won't be clear and strong enough to avoid being pierced.

Of course, that's all irrelevant unless there's a significant change in how the law treats data security.