I need to store UK Bank Account Number and Sort Code in my MYSQL database to send the users payments.

The PHP/Laravel site will be hosted on AWS with SSL & off-course the Account Number and Sort Code will be encrypted (Mcrypt) when stored in the Database, in a separate table to the users table.

The end-users will be forced to use the HTTPS version of the site.

My Question: Do I need to be PCI compliant for this? or is there any other law related issues that I need to look into before?

I have been searching all-day and have not found any solid answers hence this post.

Kind regards


It sounds like you're not processing Payment Card data and are not bound by PCI compliance. If you're using BACS Direct Credit systems you need to follow their rules.


The technical information for using BACS systems appears to be available free on registration


Note that with Confirmation of Payee being introduced, you may need to store the payee's verification name along with the bank account details; this may then make the bank accounts table liable to GDPR as personally identifiable information.

  • The bank account table is already personal information - the account can be linked to one or a small number of people. – Dale M Jul 22 '20 at 21:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.