# Schema-Tag Encryption: App Teams Tag PII, the Platform Enforces It

The platform team doesn't know which fields are sensitive. The teams producing the data do. With schema-based encryption, application teams tag fields as PII or GDPR directly in their Avro schema, and Conduktor Gateway encrypts anything carrying those tags automatically.

## What You'll Learn

- Tag sensitive fields like name, password, and salary directly in an Avro schema
- Configure one interceptor that encrypts any field tagged PII or GDPR, with no field lists to maintain
- Keep encrypted records schema-compatible, and decrypt the full record for authorized consumers