Just got a new client to do all their invoicing for their 900 clients.
Just got ALL of their customer data in an excel sheet.
Is this what they mean when they say they won't share any personal details with a 3rd party?

Had a similar situation, with nothing encrypted, and the spread sheets sitting on a shared storage disk. I explained the laws around Personally Identifiable Information, and the need for protecting the data, including tokenizing the PII data. They resisted, and hemmed, and hawed, and made excuses, so in my final reply I included Internal Audit, and everything got fixed pretty darn quickly. Over here in the US, playing loose with people's information is extremely expensive.