2
votes
2answers
753 views

What certification would be considered equivalent to the U.S.-EU Safe Harbor Framework?

The Safe Harbor website says the following: The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to ...
6
votes
3answers
1k views

If PCI DSS isn't a law, how can I be prosecuted for not being compliant?

PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
23
votes
2answers
11k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
3
votes
1answer
1k views

How to backup database to comply with UK data protection act?

Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server. Is there a cost effective solution that would allow them to ...
2
votes
4answers
256 views

What actions should be taken by site according to Data Protection legislations?

Many countries have data protection legislation: Data Protection Directive in EU Data Protection Act 1998 in UK privacy laws in USA Web application may have registration form where fields for ...
7
votes
7answers
5k views

Storing credit cards for automatic payments?

I have no experience with storing credit cards and I do not know anything about the legal end of this. The company I work for / develop for wants to store credit cards to process auto payments for ...
8
votes
2answers
193 views

How can one easily determine which IT Security related regulations apply?

Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types ...
4
votes
2answers
252 views

Issues with the use of network surveillance tool in your company?

What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ? And what policies could be ...
7
votes
5answers
966 views

What security requirements are a defacto standard in the Financial Industry?

What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry? If you're familliar with the Financial Industry, can you share details? For example: What ...