What legislation in the UK or EU requires online services and software companies to care about security of their products?
<p>... And to what extent? E.g. what is the minimum an online service or software vendor are required to do to protect personal data?
Let's not talk about PCI-DSS and payments here.</p>

<h3>What is the minimum an online service or software vendor are required to do to protect personal data?</h3>

<p>In the UK that is covered by the <a href="http://www.legislation.gov.uk/ukpga/1998/29" rel="nofollow">Data Protection Act 1998</a>. The full Act can be downloaded <a href="http://www.legislation.gov.uk/ukpga/1998/29/data.pdf" rel="nofollow">here</a> (pdf)</p>

<blockquote>
  <p>The <a href="http://www.legislation.gov.uk/ukpga/1998/29" rel="nofollow">Data Protection Act</a> controls how your personal information is used
  by organisations, businesses or the government.</p>
  
  <p>Everyone responsible for using data has to follow strict rules called
  ‘data protection principles’. They must make sure the information is:</p>
  
  <ul>
  <li>used fairly and lawfully</li>
  <li>used for limited, specifically stated purposes</li>
  <li>used in a way that is adequate, relevant and not excessive
  accurate</li>
  <li>kept for no longer than is absolutely necessary</li>
  <li>handled according to people’s data protection rights</li>
  <li>kept safe and secure</li>
  <li>not transferred outside the European Economic Area without adequate protection</li>
  </ul>
  
  <p>There is stronger legal protection for more sensitive information,
  such as:</p>
  
  <ul>
  <li>ethnic background</li>
  <li>political opinions</li>
  <li>religious beliefs</li>
  <li>health</li>
  <li>sexual health</li>
  <li>criminal records</li>
  </ul>
</blockquote>

<p>Source <a href="https://www.gov.uk/data-protection/the-data-protection-act" rel="nofollow">Data protection</a> </p>

<hr>

<h3>Guide to data protection - Information security (Principle 7)</h3>

<blockquote>
  <p>This part of the guide offers an overview of what the Data Protection
  Act requires in terms of security, and aims to help you decide how to
  manage the security of the personal data you hold. We cannot provide a
  complete guide to all aspects of security in all circumstances and for
  all organisations, but this part identifies the main points. We also
  provide details of other sources of advice and information about
  security.</p>
  
  <p>There is no “one size fits all” solution to information security. The
  security measures that are appropriate for an organisation will depend
  on its circumstances, so you should adopt a risk-based approach to
  deciding what level of security you need. In brief – what does the
  Data Protection Act say about information security?</p>
  
  <p>The Data Protection Act says that:</p>
  
  <p>"Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and
  against accidental loss or destruction of, or damage to, personal
  data."</p>
  
  <p>This is the seventh data protection principle. In practice, it means
  you must have appropriate security to prevent the personal data you
  hold being accidentally or deliberately compromised. In particular,
  you will need to:</p>
  
  <ul>
  <li>design and organise your security to fit the nature of the personal data you hold and the harm that may result from a security
  breach;</li>
  <li>be clear about who in your organisation is responsible for ensuring information security;</li>
  <li>make sure you have the right physical and technical security, backed up by robust policies and procedures and reliable, well-trained
  staff; and</li>
  <li>be ready to respond to any breach of security swiftly and effectively.</li>
  </ul>
</blockquote>

<p>...</p>

<blockquote>
  <p><strong>What level of security is required?</strong></p>
  
  <p>The Act says you should have security that is appropriate to:</p>
  
  <p>"the nature of the information in question; and
      the harm that might result from its improper use, or from its accidental loss or destruction."</p>
  
  <p>The Act does not define “appropriate”. But it does say that an
  assessment of the appropriate security measures in a particular case
  should consider technological developments and the costs involved. The
  Act does not require you to have state-of-the-art security technology
  to protect the personal data you hold, but you should regularly review
  your security arrangements as technology advances. As we have said,
  there is no “one size fits all” solution to information security, and
  the level of security you choose should depend on the risks to your
  organisation.</p>
</blockquote>

<p>...</p>

<blockquote>
  <p><strong>What level of security is required?</strong></p>
  
  <p>The Act says you should have security that is appropriate to:</p>
  
  <p>"the nature of the information in question; and
      the harm that might result from its improper use, or from its accidental loss or destruction."</p>
  
  <p>The Act does not define “appropriate”. But it does say that an
  assessment of the appropriate security measures in a particular case
  should consider technological developments and the costs involved. The
  Act does not require you to have state-of-the-art security technology
  to protect the personal data you hold, but you should regularly review
  your security arrangements as technology advances. As we have said,
  there is no “one size fits all” solution to information security, and
  the level of security you choose should depend on the risks to your
  organisation.</p>
</blockquote>

<p>The following link goes into a lot more detail on this topic.</p>

<p>Source <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/principle-7-security/" rel="nofollow">https://ico.org.uk/for-organisations/guide-to-data-protection/principle-7-security/</a></p>

<h3>Further Reading</h3>

<ul>
<li><a href="https://ico.org.uk/for-organisations/guide-to-data-protection/" rel="nofollow">Guide to data protection</a></li>
</ul>

software security