Data in an organization leaves traces with the entities that utilize it, either during processing or sharing (these entities are: logs, backend, database, data warehouse, analytics/ML, etc.) Often encryption is used to solve this problem but it doesn't solve your compliance problem. With encryption you have to use the right algorithms, right chaining mode and rotate your keys appropriately. Encryption works on the data in a holistic view and not in a granular fashion. Let us take an example: I want to delete a specific value (like email or phone number) from all the places where it has been used. Encryption can't solve this problem because it's just a data protection mechanism, In scenarios like this, you actually have to go all the places, trace out this specific email and phone number and delete it. At times, this is practically impossible because you do not have the trail of all the data traces. With Data anonymization, you never store the actual data (in this case email or phone number), but pseudorandom tokens, now letting this data get shared wherever required in the system. When it comes to deleting, updating of this specific data, it's possible because data security and compliance are applied at a granular level and at the source itself.

Encryption is a primarily a data protection technique but may not solve all the data compliance concerns. On the other hand, Anonymization and Pseudonymization protect data and demonstrate compliance.