We're developing a travel/tourist application for a tours company who want to be able to input traveler information into an online database. 

Is there any security best practice for storing passport numbers in a database? Should it be encrypted?