RE: FN-FORUM: Storing CC details?

date posted 16th May 2007 20:17

Jurai,

This is covered under the data protection act, and the freedom of
information act, as well as Sarbanes Oxley, Financial regulation act and a
host of other regulations.

I think it's not the case of "can you" it's a case of " Should you".

There are some essential questions you should ask before storing CC details.
1. What reason would you need other than making it simpler when customers
return to re-use the site.
2. Do you have the customer permission (this has to be given not accepted
as true).
3. Are you using a database that complies with BS 17799 or ISO 17799 for
storing personal data.
4. The server where the database is behind a separate network layer
isolated from the internet?

If all the above is true ( and I've missed out many more) then you need to
ensure that the personal details are kept separate from the cc details and
that both are encrypted. The database has to have referential integrity
rules applied, be normalised and have a history file.

But as far as the data protection act goes, if you have no reason to hold
the CC details then you will be in breech of the data protection act. And
this has to be a very good reason, not that it'll make life easier reason.

Couple of useful links

http://www.opsi.gov.uk/ACTS/acts1998/19980029.htm

http://www.direct.gov.uk/en/RightsAndResponsibilities/DG_10028507


Peter



> -----Original Message-----
> From: [EMAIL REMOVED] [EMAIL REMOVED] On Behalf Of Juraj
> Seffer
> Sent: 16 May 2007 19:51
> To: FN-FORUM / [EMAIL REMOVED]
> Subject: FN-FORUM: Storing CC details?
>
>
> Hi all,
>
> Any idea if storing Credit Card details in a database (except CVV) is
> legal in the UK and if it requires a licence?
>
> Thanks
> Jay
>
> --
> Freelancers, contractors earn more with Prosperity4
> Call 0870 870 4414 or visit www.prosperity4.com
> and benefit from Inland Revenue approved expenses today.
>
> To advertise here: http://www.freelancers.net/advertising.html
>
>