1. A method for controlling access to personally identifiable information (PII) in a database system, comprising: receiving a request from an application to perform a function which involves accessing information in the database system; identifying a purpose that the application has in making request to perform the function; using the purpose to identify a set of attributes in the database system which are associated with the purpose; and determining if any of the identified attributes contain PII, and if so enforcing access controls while accessing the identified attributes containing PII.