Have you considered using a third party processor to handle the credit card transactions for your site ? With all the requirements being pushed down through the
VISA/MASTERCARD PCI DSS to basically put ALL the liability on you.. Implementing all the controls to meet these requirements is expensive, not doing so can be more expensive in fines, fees, and corporate reputation.
Quite honestly for a low volume site I would outsource the transactions.
the 12 requirements for compliance listed on the wikipedia site are just brief topic headers.. you need to download the entire standard to see all the actual requirements. [Card number Masking/encryption of data/extensive access logs/much much more..]
Obviously there are downsides to third party processors as well (FEES)
http://www.chargecentral.com/Third-P...rocessing.html
but have you seen the
Fines levied by PCI recently ?
http://www.threadwatch.org/node/13910
If you accept credit cards for transactions as a merchant YOU ARE SUBJECT TO PCI REGULATIONS
Personal information (depending on what it is) could be subject to other federal regulations..
