Legal Question in Credit and Debt Law in California

The US has few privacy laws outside the areas of health care, credit reporting, and government, so if someone is dumb enough to give you their SSN, or you have some legitimate need for it, you might be able to lawfully store it in a database. Without more information as to what business you are in, and how you obtain and use this information, I am unable to opine further. Don't assume any of your data is 100% secure regardless of the precautions you might take. Good defensive computer security costs money and requires talent.