Best Approach for PII and Databases
Typical implementations that I'm familiar with, dealing with PHI (protected health information), which has stricter rules than simple PII, use these technical components:


Data-at-rest encryption, which includes either database-level encryption where supported by the DBMS or disk-level encryption, as well as backup and archived transaction log encryption.
Data-in-transit encryption, which essentially means TLS or IPSec for all network links.
Encryption key management system.
Row- and column-level access control. This should be implemented at the database level if the DBMS is capable of it, or in the application layer otherwise.
Network access control through explicit whitelisting (all network paths and ports are locked down by default and only open where needed).
Security monitoring of network traffic, OS and database logs for unusual access patterns.
Audit logging of all access paths, both at the database level (using database wire protocol capture if the DBMS has no native audit facility) and at the application level.
Secure erasure of data beyond its retention period.


This should cover most compliance requirements when implemented properly and augmented by the necessary organizational measures (identity and access management, separation of duties etc.)

The corollary of the above is that MySQL/MariaDB may not be a good choice for your use case.