I've worked for a few companies that handled clients' private information for financial purposes. There is a standard that you must observe if you work with payment cards, PCI-DSS. It is complicated and costly to implement in full, so some of the firms I worked for didn't - and instead avoided handling sensitive data that was subject to the strongest of protections specified by PCI-DSS. That meant, for example, never directly handling transactions and bouncing them off to PayPal instead. These were still successful companies, that kept growing while I was working for them.

One company I worked for sold software for card transactions and so needed to get the highest level of certification. They did and they worked very hard to achieve this, which is why they were (and I believe, still are) highly respected in the business. They also did great financially and had big contracts with huge clients.

There's also companies that specialise in that sort of thing- they help others get their PCI-DSS on. For a fee- but it's cheaper than doing it yourself, or paying the price of running wild with peoples' card data.

There are many more options than "ignore the standard" and "drown under it" is what I'm trying to say.