All of that data is subject to protection from multiple laws, that can reach across various jurisdictions. U.S. retailers, for example, strive to demonstrate compliance with the PCI DSS framework to protect credit card data. A business that collects data about European Union citizens will need to confront the EU’s General Data Protection Regulation.