Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A certain government regulation in my country mandates all non-resident donors to provide a copy of their identification (usually, the passport).

So, we ask the donors to upload a copy of their passports while making a donation on our website. (Which is then verified by our admin, internally)

We have taken measures to ensure that the images are stored carefully and that they cannot be retrieved by an external user on www (and the access to this data is limited to only a few people in our organisation). However, some donors are still skeptic about the safety measures taken by us.

Question : Are there any industry-wide standards that provide guidelines on how to store this information? Are there auditing agencies who can audit our practices related to this? Something like what PCI is for credit cards?

share|improve this question
add comment

migrated from webmasters.stackexchange.com Sep 14 '13 at 12:13

This question came from our site for pro webmasters.

1 Answer

Various countries have their own regulations on this, for example the UK has the Data Protection Act 1998 ( http://www.ico.org.uk/for_organisations/data_protection ) and there is HIPAA in the US ( http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html )

Also some regions such as the EU mandate data protection regulations for their member states.

All the major IT audit firms, such as EY, KPMG etc can do data protection audits.

share|improve this answer
    
Thanks Rory. wrt the first part, do you have a handy link where I can read the regulations from UK/US? –  TJ- Sep 14 '13 at 12:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.