-1

I need to store UK Bank Account Number and Sort Code in my MYSQL database to send the users payments.

The PHP/Laravel site will be hosted on AWS with SSL & off-course the Account Number and Sort Code will be encrypted (Mcrypt) when stored in the Database, in a separate table to the users table.

The end-users will be forced to use the HTTPS version of the site.

My Question: Do I need to be PCI compliant for this? or is there any other law related issues that I need to look into before?

I have been searching all-day and have not found any solid answers hence this post.

Kind regards

1

It sounds like you're not processing Payment Card data and are not bound by PCI compliance. If you're using BACS Direct Credit systems you need to follow their rules.

https://www.bacs.co.uk/Resources/Pages/GuideAndRules.aspx

The technical information for using BACS systems appears to be available free on registration

https://www.bacs.co.uk/Access/BacsApprovedServices/BacsApprovedSoftwareService/Pages/BacsApprovedSoftwareService.aspx

Note that with Confirmation of Payee being introduced, you may need to store the payee's verification name along with the bank account details; this may then make the bank accounts table liable to GDPR as personally identifiable information.

  • The bank account table is already personal information - the account can be linked to one or a small number of people. – Dale M Jul 22 '20 at 21:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.