A certain government regulation in my country mandates all non-resident donors to provide a copy of their identification (usually, the passport).
So, we ask the donors to upload a copy of their passports while making a donation on our website. (Which is then verified by our admin, internally)
We have taken measures to ensure that the images are stored carefully and that they cannot be retrieved by an external user on www (and the access to this data is limited to only a few people in our organisation). However, some donors are still skeptic about the safety measures taken by us.
Question : Are there any industry-wide standards that provide guidelines on how to store this information? Are there auditing agencies who can audit our practices related to this? Something like what
PCI is for credit cards?