There are no concrete requirements and the verbiage is little vague, therefore it's best to get a lawyer to interpret the laws to form requirements

Buzz word: privacy by design. 

The session wasn't a developer session and would probably been really beneficial for the hire ups to have listened to, so that they better understand the risk in storing user data.