This is partly a legal question (which in turn depends on where you are based) and partly a question about whether it would be good practice to use ecnryption regardless of the legal obligation to do so.
The data you are handling would be treated as personal data for the purposes of European data protection laws. If you're trading with EU citizens, you will need to comply with those laws. The thing about EU data protection law is that it says more about objectives and less about how you achieve those objectives. So, you will have an obligation to protect the data, but it doesn't tell you how to do so. Having said that, if you decide not to adopt the 'normal' ways of ensuring the protection, you increase the chance that someone will say you're in breach. So, encryption isn't a legal requirement if you can protect the data in some other way. I would doubt that you can.
If you're outside thereach of European data protection laws, then you need to look at whether your jurisdiction has specific laws about this sort of thing. I've not heard of any legal requirement for encryption, so I would be a bit surprised.
I thin the real question you need to ask is this: do I want to offer protection for this data and, if I do, what's the most sensible way to do it? Answer Yes to the first part of that question, and come up with a reasoned answer to the seond part and I doubt you will go wrong in any legal regime.