Mechanisms exist to limit Personal Data (PD) contained in audit records to the elements identified in the data privacy risk assessment.