In simple terms, it comes down to a few rules, such as:
If you're storing customer data, you must ask explicit permission to do so.
and provide assurances you will not share the data unless you explicitly name the parties who you'll share it with. And you must provide the customer the ability to remove their information, and then upon receipt of this request you must pass it forward to all parties whom you've provided the information to.