PCI DSS
Payment Card Industry Data Security Standard
Not a law. PCI DSS is a contractual industry standard from the PCI Security Standards Council, enforced through card brand rules and merchant and acquirer agreements. Some laws reference it, but its force comes from contracts.
In force: First published 2004; version 4.0 released March 2022, with 4.0.1 in June 2024; requirements that were future-dated became mandatory on 31 March 2025
Who it applies to
Any entity that stores, processes or transmits cardholder data or sensitive authentication data, or can affect the security of that environment, including service providers.
Key requirements
- 12 principal requirements under six goals: secure networks, protect account data, vulnerability management, access control, monitoring and testing, and security policy.
- Never store sensitive authentication data (such as full track data or CVV) after authorisation.
- Render stored primary account numbers unreadable, and encrypt them over open, public networks.
- Multi-factor authentication for access into the cardholder data environment.
- Regular vulnerability scans by an Approved Scanning Vendor and penetration testing.
- Annual validation through a Report on Compliance or Self-Assessment Questionnaire, depending on level.
Breach and incident notification
Set by card brand rules and the entity's agreements with its acquirer, not by PCI DSS itself. Legal notification duties come from applicable breach laws.
Penalties
Contractual: fines passed on by acquirers, increased fees or loss of the ability to accept cards. These are not statutory penalties.
Related frameworks
Shows up on these exams
Official source
PCI Security Standards Council: document libraryNot legal advice
This is a study summary, not legal advice. Laws and their guidance change, and obligations depend on your facts and jurisdiction. Check the official source and the current, dated text, and consult a qualified lawyer before acting.