I agree in general that you need to enforce things at the storage layer.
As a rule I don't cache personal information for this reason.
Out of curiosity do you have any knowledge on GDPR's stance on caching PI?