Database Security.

My database provider has asked me to send them a backup drive by post.

I'm not going to comply. I've sighted this as my reason.

I accept that they need to check the integrity of the data. However, I feel that a request such as this should be in writing so as to create a paper chain showing that a disk in the post was

1. absolutely necessary given the risk to my business of the possible bad publicity if it goes astray
2. done with adequate encryption

These issues are on-going.
I need to find myself a good IT aware lawyer, as soon as possible, to help me get these guys on the right track.