Who the PCI DSS applies to

The PCI DSS applies to any organisation that stores, processes or transmits cardholder data, regardless of size or transaction volume. This includes:

• Merchants (online and in-person)
• Service providers handling cardholder data on behalf of others
• Payment processors

Compliance Requirements

Organisations must comply with 12 high-level requirements, grouped into six control objectives. Exact compliance obligations vary based on the organisation’s merchant level, which is defined by the number of transactions processed annually and the associated risk.

Consequences of non-compliance

• Card brands may fine acquiring banks if their merchants are found to be non-compliant or involved in a data breach.
• Acquiring banks may in turn:
  • Pass costs or penalties on to merchants
  • Increase transaction fees
  • Withdraw the ability to process card payments
• Additional consequences include:
  • Legal liability in the event of a breach
  • Reputational damage and loss of customer trust