Only a third limit employee access to user data, and just 40 percent encrypt it.