In some regions, companies are legally required to ensure personal data is protected. It's against the law for them to not protect it.