If your business has personally identifiable information on customers, employees, or vendors, then you are required to safeguard that personal information.