I work for a head hunting company with offices in Canada and Asia. We migrated our custom built CRM system from our own servers hosted in Japan to an Amazon hosting service meaning that all our data is now held on Amazon servers in the US.
Data includes names, dates of birth, contact details, current and previous places of work, current and previous salary, full resumes, notes on information learned from candidates that could be anything from domestic issues preventing them from changing job to confidential insights into their current employer. Basically everything you would need to perform identity theft, limited corporate espionage or in some cases blackmail. Although I do not have the exact number, it is between a quarter and half a million records in varying states of completion.
If relevant, all connections from users are via IP filtered HTTPS. The developers connect by the standard Amazon SSH policy. SNMP and NRPE are also accessible but again IP filtered. The database is not encrypted and the server instance is replicated (files and database) in plain text to another server instance on the same local Amazon subnet.
When in Japan, all the data fell under Japanese law which we were able to cover. However, without a corporate entity in the US, I have no idea what if any laws, standards or audits we are meant to be following with regards to data security. Would it be US laws/standards as the CRM and data are now in the US? Canadian laws/standards as that is the nearest entity and that office actually maintains the CRM system? Japanese law/standards as the Japan office is the biggest and has generated the majority of the data? Some international laws/standards I am unaware of?
If possible, can you please provide links to the relevant information/standards/professional bodies in your answers? I am more than happy to do the footwork if you can point me in the right direction.