Businesses are required by federal and state laws to secure personal information like social security numbers and credit card numbers. Non-compliance with these laws could result in stiff penalties such as large fines, business closure, and lawsuits. Identity theft prevention programs and staff training are required to help businesses protect sensitive information and establish a culture of security. Outsourcing does not absolve businesses of responsibility - they must exercise oversight of service providers and ensure compliance with identity theft laws.