A certain government regulation in my country mandates all non-resident donors to provide a copy of their identification (usually, the passport).

So, we ask the donors to upload a copy of their passports while making a donation on our website. (Which is then verified by our admin, internally)

We have taken measures to ensure that the images are stored carefully and that they cannot be retrieved by an external user on www (and the access to this data is limited to only a few people in our organisation). However, some donors are still skeptic about the safety measures taken by us.

Question : Are there any industry-wide standards that provide guidelines on how to store this information? Are there auditing agencies who can audit our practices related to this? Something like what PCI is for credit cards?

1 Answer 1


Various countries have their own regulations on this, for example the UK has the Data Protection Act 1998 ( http://www.ico.org.uk/for_organisations/data_protection ) and there is HIPAA in the US ( http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html )

Also some regions such as the EU mandate data protection regulations for their member states.

All the major IT audit firms, such as EY, KPMG etc can do data protection audits.

  • Thanks Rory. wrt the first part, do you have a handy link where I can read the regulations from UK/US?
    – TJ-
    Sep 14, 2013 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .