I’ve been doing some research for the small businesses I look after. I’ve attended webinars from people like BitDefender, Hikvision and Synology. It’s nothing to panic about and all common sense. There’s a lot of scaremongering about too. I’m sure you’re doing all of the techie things already, the bit that’s usually missing is formal documentation of your procedures (this basically shows you’ve thought about it and done something about it).
Get permissions (T & Cs) for what you want to do and only do that. Only collect the information that you need to do that.
Keep peoples data safe by doing all you can to protect it from the bad guys, that means keeping security patches up to date, firewalls and AV. It also means user IDs and passwords at your end as well as ours. For backups to places like my server or Dropbox etc. encrypt them and password protect them.
Formally ask me what my procedures are for compliance on my server that you’re storing the encrypted backups on. If any data breach could be traced to me you’d be covered, but then as it’s encrypted and password protected then even if someone got at the backups there’s sod all they could do with it any way.
Having PayPal deal with the financial transactions is a huge tick. If you can’t trust them to do all of the above then who could you trust? and you won’t be holding any sensitive data yourself.
From the Forumite side I’d say you have very little to be worried about hosting a community forum where the only transactions are from people volunteering donations via PayPal.
.
