What is PCI DSS? The card data security standard explained

PCI DSS (Payment Card Industry Data Security Standard) is the global security standard for any business that stores, processes or transmits payment card data. It is maintained by the PCI Security Standards Council (PCI SSC) and applies to every merchant that accepts cards, as well as processors, acquirers, issuers and service providers.

Who it applies to

The PCI SSC says the standard covers entities that store, process or transmit cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment. Its glossary defines a merchant as any entity that accepts payment cards bearing the logo of a participating payment brand. PCI DSS is not a law. It is enforced through contracts: acquirers are subject to payment brand rules on merchant compliance, and they pass those obligations on to the merchants they serve.

What it requires

The standard contains 12 requirements, grouped under goals that run from building a secure network and protecting stored card data to vulnerability management, access control, monitoring and testing, and an information security policy.

The current version

  • PCI DSS v3.2.1 was retired on 31 March 2024.
  • PCI DSS v4.0.1, a limited revision with no added or deleted requirements, was published in June 2024. v4.0 was retired on 31 December 2024, leaving v4.0.1 as the only active version.
  • Of the 64 new requirements introduced in v4.0, 51 were future-dated and became effective on 31 March 2025.

Among the v4.0.1 clarifications are applicability notes on managing scripts on payment pages, an issue for any online checkout.

How to reduce your scope

The less card data touches your systems, the less of PCI DSS you have to meet. Compare two hypothetical stores: one where card numbers are typed into a form on its own server, and one where they are entered in fields hosted by a PCI-compliant payment provider. The second store never receives the card number, so far fewer of its systems are in scope. Scope also decides which self-assessment questionnaire fits (see SAQ A). Which assessment and report you must file is set by your acquirer and the payment brands; in an August 2026 update to FAQ 1331, the PCI SSC advised merchants to always confirm their validation and reporting requirements with them.

Common mistakes

  • Assuming a compliant payment gateway makes your store compliant automatically. It reduces your scope but does not remove your responsibilities.
  • Letting marketing or analytics scripts run unchecked on the payment page.
  • Keeping card numbers in emails, spreadsheets or support tickets.
  • Confusing PCI DSS with 3-D Secure: one secures card data, the other authenticates the shopper.

Sources