Is it legal to retain customer card details when making transactions over the phone (UK)?
<p>In a small business we have people who make orders over the phone (commonly known as card not present). Common practice is to directly input the details into the machine as the customer reads them out. </p>

<p>One of the chaps in the office is adamant that, they read out the details and  I write them down and not input them in the machine, once the customer is done telling me the details I say that I will call them back with payment confirmation.</p>

<p>I would then in my own time input the details into the card machine and process the payment and if all goes through, I would shred the paper immediatly and notify the customer.</p>

<p>I don't feel comfortable writing the details down, I've told this chap many times. Is there a legal way I could tell him so he won't pressure me to do this in the future?</p>

<p>There is no legal prohibition about copying and storing credit card details. The data must be protected from loss or theft and the proposed procedure seems to do this (assuming a cross-cut shreader and that the waste is securely disposed of). </p>

<p>In any event, as an employee, you are not responsible for any damage (assuming no criminality on your part), your employer is. Your employer has given you a lawful and reasonable instruction, you have raised concerns, those have been rejected: now, do as you're told.</p>

privacy