Future IT is the organisation which is providing different managed IT services to its clients. They are selling their services over the internet, and customers are paying using the credit cards. Future IT is keeping records of the customer credit cards and personal details on the SQL database. The database used by Future IT is not secured to the industry standards, and with a bit of knowledge, bad actors can access it. Future IT has not thoroughly implemented the privacy policy and invested in data protection policy. Recently Future IT disclosed there has been a cyberattack where unknown number of credit card details and personal identification information of the customers were stolen. Future IT Customer Service has notified the management that clients are coming back to the organisation telling their money is gone from the accounts and suspect the leak originates from Future IT database What legal obligations does Future IT has to face? What laws have been breached in this scenario