It depends on the type of data you're holding but basically if you are a company (not sure of Chris has formalised his business into a company) you will probably be bound by the data protection act and if you process customer card details via a merchant the PCDISS. As a private individual I'm not so sure that's much of an issue.