PCI DSS
Also known as: PCI, Payment Card Industry Data Security Standard
PCI DSS is the Payment Card Industry Data Security Standard, a baseline of technical and operational requirements for protecting payment account data. It applies to entities that store, process or transmit cardholder data. Card brands and acquirers decide who must demonstrate compliance.
Last reviewed
Example
A webshop that sends customers to a hosted payment page never stores the card number, which keeps its own PCI DSS workload small.
PCI DSS is the rule that says what you must do if card numbers pass through your hands.
It is not a law. It is an industry standard written and maintained by the PCI Security Standards Council. The Council describes it as "a baseline of technical and operational requirements designed to protect payment account data".
Who it applies to
Anyone who stores, processes or transmits cardholder data. That includes merchants, processors, acquirers, issuers and service providers. A one-person shop that takes cards is in scope. So is a global platform. The effort is very different.
Who checks
The Council writes the standard. It does not police it. Whether an organisation has to prove compliance is, in the Council's words, "at the discretion of organizations that manage compliance programs", such as the payment brands and acquirers. In practice, ask your acquirer what evidence they expect from a business of your size.
The practical way to shrink the problem
The less card data you touch, the less you have to protect. Hosted payment pages, payment terminals that encrypt data at the point of entry, and tokens in place of card numbers all keep card data out of your own systems. Payment terminals that protect PINs are tested under a separate Council standard, PTS POI.
Versions
As of October 2026 the current version is PCI DSS v4.0.1, published in June 2024. v4.0 was retired on 31 December 2024. Check the Council's document library for the version your acquirer expects.
Compliance is not the same as being safe. It is the floor.