data retention and encryption ala tjmaxx

With the TJ Max debacle playing out in the media, I need to make a
recommendation to several customers who handle credit card trans. 
Is there a short & concise list of standard practices as to when to keep
customer data versus when not to...
I have searched the web and find that everyone seems to have a different
opinion, and much of it sounds like "talking heads..".
Perhaps an industry association recommendation, or something from the
card processors that I can get to (that is not a 800 page manual). 
In one case, iSeries custom software for private (non-standard) cards in 
addition
to major labels. Another has pc based swipe machine and settle software, but
then keys the tran onto the iSeries (and I need to recommend for both iSeries
and pc).
None of these customers fit a "traditional" retailer model. 
Jim Franz