What is the best measure that I can use it in such case?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Need more information to give you a better answer. But in general you need to work out what information you want, why you want it and what local laws, regulations and guidelines you have to be compliant with. Then document and produce a report on the conclusions of this process.
Once you have done that, you should perform a full audit of your systems, the information you are currently collecting and how you are storing that information. Then align it with the documentation from phase one.
Here are a couple of handy links to point you in the right direction;