Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since the Legal site of Stack Exchange isn't ready quite yet, I figured this would be the best place to ask this question.

What are, if any, the legal requirements (or online resources for finding this info out) that I must uphold if I wish to sell an application that acts as a Personal Account/Information Manager, which:

  1. Stores (optionally, but preferably) personally identifiable information, and;

  2. Stores (optionally) bank account information, such as existing and current balance, and transaction history, entered by the user.

With regards to encryption, is there a legal standard of encryption that we as developers must use for securing this type of information?

share|improve this question

migrated from Apr 27 '11 at 5:08

This question came from our site for professional and enthusiast programmers.

I am not a lawyer, but I can't imagine there's any law (in the US) which places a particular responsibility on you as an independent developer. If you worked for a financial institution there definitely would be laws and industry standards to be followed.

But as an independent developer, you still could open yourself up to potential litigation by your customers should you fail to take reasonable measures to secure their sensitive data and it gets stolen. Best bet would be to consult with knowledgeable attorney to decide what "reasonable measures" entails.

Upon further thought, you might perhaps consult with an attorney to see if Sarbanes-Oaxley might have an impact, depending on your company's structure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.