The first question to answer is: Do you have to store that information? The best practice is to store as little private info as you can. Assuming you have a real business need for it:
I would suggest a SSL certificate to start with. Make sure your web server is set to redirect port 80 to 443 to make sure all traffic goes over HTTPS.
Encrypt the data as soon as you get it, and keep it that way until the absolute last moment you need it in clear text. Use AES to encrypt the data. Use a good validated implementation. DO NOT ROLL YOUR OWN ENCRYPTION.
Make sure your server is up to date on all security patches (and keep it that way). Run a tight firewall, with only the minimum ports open (80 and 443?).
Monitor your servers for unusual activity.
DO NOT STORE THE DATA ON THE WEB SERVER HOST. Pass all of the data to a machine that is not publicly accessible.
Pay attention to compliance laws in the state your server is residing. You may be governed by a variety of disclaimer, disclosure, and data breach laws.
PCI DSS guidelines are useful. But, be aware that they are focused on one thing, preventing the disclosure of credit card account holder data.