RE: data retention and encryption ala tjmaxx

By accepting credit cards (Visa at a minimum but pretty much everyone
else is on board) your customers have probably agreed to adhere to the
Payment Card Industry Data Security Standard.
https://www.pcisecuritystandards.org/ has a link to the standard itself.


I haven't read it through but my understanding is that the ramifications
for violating PCI can include heavy fines and loss of ability to accept
credit cards.  I'd urge following whatever guidelines it provides.