You need PCI DSS compliance if you store, process or transmit cardholder data. This applies to every organisation handling payment cards, from solo traders to large enterprises. The rules do not depend on transaction volume. If you accept cards, you must follow the standard or use a compliant payment service to shift the burden.
Do I need PCI DSS compliance?
You need PCI DSS compliance if your organisation handles cardholder data at any stage of the payment lifecycle. The Payment Card Industry Data Security Standard applies to any entity that stores, processes or transmits card details. This includes merchants, service providers and even third parties with access to the data. There is no minimum transaction threshold. If you accept a single card payment and touch the data, you fall under the standard. The obligation exists to protect cardholders from fraud and to maintain trust in the payment ecosystem.
What data triggers the requirement?
The requirement triggers when you handle Primary Account Numbers or PANs. This is the full card number printed on the front of the card. It also includes sensitive authentication data such as full track data from magnetic stripes, chip PIN data and PIN blocks. You do not need to comply if you only handle truncated card numbers, typically showing just the last four digits. You also do not need to comply if you handle only card verification values or CVVs. These specific data elements define the scope of your compliance efforts.
| Data Type | Requires PCI DSS? | Reason |
|---|---|---|
| Full Card Number | Yes | Identifies the account holder directly |
| Last 4 Digits | No | Considered truncated and non-sensitive |
| CVV / CVC | No | Excluded from storage requirements |
| Magnetic Stripe Data | Yes | Contains sensitive authentication data |
| Token ID | Depends | Requires validation of the token service |
Can I avoid compliance by using a gateway?
You can reduce your compliance scope by using a payment gateway or a hosted payment page. These services process the card data on their servers, not yours. This shifts the burden of securing the card data to the payment service provider. You must still secure your own systems, as attackers often target the merchant to inject malware that steals data before it reaches the gateway. This is known as skimming. You remain responsible for securing the network that connects to the payment service.
How is my compliance level determined?
Your compliance level is determined by your annual transaction volume and your implementation method. Merchants typically fall into one of four levels based on the number of card transactions they process each year. Level 1 merchants handle the highest volume and require an annual on-site audit by a qualified security assessor. Lower levels may allow for self-assessment questionnaires. Service providers have different criteria based on the volume of transactions they process on behalf of others. The level dictates the rigor of the validation process.
What happens if I am not compliant?
Non-compliance exposes you to significant financial and operational risks. Card brands and acquiring banks can impose fines for failing to meet the standard. These fines can accumulate monthly until you achieve compliance. More severely, your payment processor may terminate your account. This stops all card payments, halting your business operations. You may also face liability for fraud losses that occur due to inadequate security. The cost of remediation is often lower than the cumulative fines and lost revenue.
What are the first steps to take?
You must begin by mapping your network and identifying all systems that handle card data. This is called scoping. You need to list every server, application and network device that touches the data. Next, you must implement firewalls and secure network configurations. You should also establish access controls to ensure only authorised personnel can access cardholder data. Encrypting stored data and transmitted data is mandatory. These technical controls form the foundation of your security programme.
Imagine a small online store that uses a simple e-commerce plugin. The owner assumes the plugin handles security. However, the plugin sends data to a server the owner controls. This server becomes part of the PCI DSS scope. The owner must secure that server, patch the operating system and restrict access. Ignoring this hidden connection leaves the entire payment flow vulnerable.
How do third parties affect my scope?
Third-party vendors can expand or shrink your compliance scope. If you outsource payment processing, you must ensure those vendors are themselves compliant. You should request their compliance certificates and review their security practices. This is part of managing third-party risk. If a vendor suffers a breach, you may still be held accountable if you failed to verify their security posture. You must maintain a record of all service providers and their compliance status.
What is the ongoing maintenance cost?
PCI DSS compliance is not a one-time project. It requires continuous monitoring and regular reassessment. You must scan your network for vulnerabilities at least quarterly. Internal audits should happen regularly to check for policy drift. Staff training is required to ensure employees understand security procedures. The hidden cost is the administrative overhead of maintaining documentation. You must keep records of all security measures, tests and assessments. Failure to maintain these records is treated as non-compliance.
When does the standard apply to digital wallets?
The standard applies to digital wallets and mobile payments if they expose card data to your systems. If you use a tokenisation service that replaces the card number with a unique identifier, your scope may be reduced. You must verify that the token cannot be reversed to the original card number. If you store the token, you must secure it. If you process payments via QR codes that contain card data, you are handling cardholder data. The method of presentation does not remove the obligation to protect the underlying data.
Key takeaways
- Handling card numbers directly requires full PCI DSS adherence, regardless of business size.
- Using payment gateways can reduce your scope, but you remain responsible for your own security posture.
- Non-compliance risks include fines, loss of processing privileges and mandatory forensic audits.
Handling any full card number mandates immediate adherence to the standard, regardless of your business size or transaction frequency. Conduct a network scope assessment today to identify every system touching payment data and begin documenting your security controls.
Frequently asked questions
Does PCI DSS apply if I only accept payments in person?
Yes, if you use a card reader that transmits data to your system or if you manually key in card details, you are processing cardholder data and must comply.
Can I use a self-assessment questionnaire for any business size?
Only if your transaction volume falls below the threshold for Level 1. High-volume merchants must undergo an external audit by a qualified security assessor.
What if I use a payment service that claims to handle everything?
You must verify that their solution does not require you to store or transmit card data. If you do not touch the data, your scope is significantly reduced, but you must still secure your connection.
How long do I have to become compliant?
Compliance is an ongoing requirement
How this guide was produced: written by the Cipher Insider editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
