Tokenization vs Encryption: What Actually Takes Data Out of Scope

"We encrypted everything" does not take a system out of PCI DSS scope, and tokenization does not take you out of GDPR. A practical guide to what each one actually buys you — and where teams get it wrong.