In a certain respect, everyone is required to protect personal information in as much as anyone can be sued for failing to do so. Perhaps unsuccessfully, but a healthy bit of CYA is in order whenever you deal with the litigious masses.
Finally, depending on your industry, you may be under further obligation. There's plenty of regulation surrounding banking, for example. And remember the law that makes it illegal to disclose someone's video rental history? All it takes is one embarrassed senator and the legal environment can change in the most unexpected ways.