Safe Harbor

PCIComplianceHubLast updated

The protection a payment brand may extend to a merchant or service provider that suffers a compromise but can show it was PCI DSS compliant at the time, reducing or waiving the penalties that would otherwise follow. The term belongs to the brands' compliance programmes and acquirer agreements, not to PCI DSS, and each brand sets its own conditions.

Applies to. PCI DSS v4.0.1 does not mention safe harbor and offers no protection of its own. The idea lives in the payment brands' compliance programmes and in acquirer agreements: an entity that is breached but can show it was compliant at the time of the compromise may have some non-compliance penalties reduced or waived, and in practice the forensic investigation after the breach decides whether that was the case. Whether it applies, and to what, is between the entity, its acquirer and the brand.
Limits. Safe harbor is not a PCI DSS term, requirement or assessment outcome. A ROC or AOC records compliance status at a point in time and confers no protection by itself.
Related. Payment Brand, Acquirer, Compliance, Data Breach, PCI Forensic Investigator (PFI)
Sources. PCI DSS v4.0.1 (June 2024)