There are whole branches of data security, practices, and products dedicated to answering that question and managing that risk.

The similarities look obvious, but how are these situations different? Seems like an interesting question.