Yes there are. Statutes like the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act (HIPPA), the Fair Credit Reporting Act, and the Federal Trade Commission Act may require you to provide reasonable security for sensitive information. To find out more, visit www.ftc.gov/privacy.