PCI DSS (Payment Card Industry Data Security Standards)
PCIComplianceHubLast updated
The Payment Card Industry Data Security Standard, a set of technical and operational requirements applying to every organization that stores, processes or transmits account data, and to any system that could affect the security of that data. It is maintained by the PCI Security Standards Council on behalf of the major payment brands. The current version is v4.0.1, published in June 2024. Every v4.x requirement, including those originally published as future-dated, became mandatory on 31 March 2025.
Applies to. Any organisation that holds, handles or moves account data, and any system that could affect that data's security, in whatever channel: card-present terminals, mail and telephone order, and e-commerce. It applies requirement by requirement to in-scope system components and, through Requirement 12, to the organisation's policies and people. Service providers carry additional requirements, including executive responsibility for a PCI DSS compliance programme (12.4.1) and scope confirmation at least every six months (12.5.2.1) instead of every 12 (12.5.2).
Example. A regional retailer runs card terminals in its shops, takes phone orders and sells online through a hosted checkout. All three channels bring it under PCI DSS. It validates its own environment through the programme its acquirer sets, while the hosting company and the payment gateway each validate separately as service providers.
Limits. PCI DSS is not a law: it is imposed through payment brand rules and the contracts merchants and service providers hold with acquirers, and the Council that maintains it does not enforce it. It does not set merchant or service provider levels, decide who files an SAQ or a Report on Compliance, or set fines; the payment brands do. It covers account data only, not personal data in general, so meeting it says nothing about privacy law. It is one of several Council standards; the Software Security Framework, PTS and P2PE cover payment software and devices and are validated separately.