In the DoD arena we prescribe to a security called FIPS-140.  Basically, it
requires encryption of all the network and a closed environment and
extending beyond that is all the issues of vault certification and physical
plant protection.  Sounds like there has been no government classification
placed on this data as yet, but I would bet it would come under some Privacy
Act already in place.

This is a legal question.  Your business needs to get this right, otherwise
you have no business.  A top down exposures and mitigation need to be
performed.