Under EU law, you must obtain a Privacy Bank Number before you store or manipulate that kind of information.
The application will require that you submit documentation of:
- what fields you will collect
- who will have access to the information
- your retention policies
- your policies on ability of people to get a copy of the information relevant to them, and to make corrections to the information
