The real difficulty is getting government or financial institutions to buy in, they have LONG approvals processes and require proof that certain security practices are being adhered to (ISO27001 helps but is costly).
I always wonder, “How are these random companies able to convince folks to just give them personal data like that?” And of course, I already know the answer: Practically speaking, most folks don’t give a damn about their data! That’s unfortunate. (Well, not so unfortunate for the companies collecting all of it and their data brokers!)