PCI DSS (Payment Card Industry Data Security Standard) is a set of technical and operational security requirements for any organisation that stores, processes or transmits cardholder data. It is maintained by the PCI Security Standards Council, which was founded by the major card networks.
Why it matters
Card networks and acquirers contractually require merchants and service providers to comply. The requirements cover areas such as network security, encryption of stored data, access control, monitoring and testing, and policies. The depth of validation depends on volume and how card data is handled: a merchant using a hosted payment page or redirect has a much smaller scope than one that receives card numbers on its own server. Noncompliance can lead to fines from acquirers or loss of the ability to accept cards, and it does not itself guarantee that no breach will occur.
Example
A small shop integrates a gateway's hosted checkout so the card number goes straight from the customer's browser to the gateway. The shop's server only receives a token and payment status. Its compliance questionnaire is far shorter than that of a business that stores card numbers in its own database.
Common mistakes
- Thinking compliance is a one-time certificate. It is ongoing and reviewed periodically.
- Storing CVV or full card data in logs.
- Assuming that using a gateway removes all responsibility.
Rules vary by country and contract; this entry is a definition only.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.