Term · Security & infrastructure
PCI DSS
PCI DSS — the Payment Card Industry Data Security Standard — is a set of security requirements for any organisation that stores, processes or transmits payment card data. It is maintained by the PCI Security Standards Council, founded by the major card brands; the current generation is version 4.0, with its 4.0.1 update.
[ 01 ]
Explained
What it covers
Requirements grouped around building secure networks and systems, protecting account data, managing vulnerabilities, controlling access, monitoring and testing, and maintaining security policies.
Who it applies to
Any merchant or service provider accepting card payments. The extent of obligations depends on transaction volume and, above all, on how card data flows through your systems. Banks and payment providers tell merchants which assessment applies — often a self-assessment questionnaire for smaller merchants.
Reducing the burden
- Hosted payment pages or provider-hosted fields: card data goes directly to the payment provider and never touches your servers, keeping your scope small.
- Tokenisation: for saved cards and subscriptions, store the provider's token, not the card number.
- Never store full card numbers or security codes in your database, logs, emails or CRM.
What merchants still own
- Security of the website that leads to the payment page — a compromised site can redirect customers or inject malicious scripts.
- Verification of payment notifications.
- Access control to payment dashboards.
- Staff procedures for any card data handled by phone.
See PCI DSS for online stores and payment gateway integration.
[ 02 ]
FAQ
Frequently asked questions
Does a small online store need to comply?
Yes, in proportion to how it handles card data. With a hosted payment page, obligations are much lighter.
Is PCI DSS a law?
It is an industry standard enforced through contracts with banks and card brands, not a law — but non-compliance can lead to fines and losing the ability to accept cards.