PCI DSS (Payment Card Industry Data Security Standard) is a global security framework designed to protect payment card information. It applies to any organisation that accepts, stores, processes, or transmits cardholder data.

The standard was created by the Payment Card Industry Security Standards Council (PCI SSC) and is supported by the major card schemes including Visa, Mastercard, American Express, Discover and JCB.

PCI DSS sets out a range of security requirements to help businesses:

• Protect customer payment information

• Reduce the risk of fraud and data breaches

• Secure payment systems and networks

• Maintain customer trust when handling card payments

If your business accepts card payments in person, online, or over the phone, PCI DSS compliance is required.

The official PCI DSS standards are published by the Payment Card Industry Security Standards Council (PCI SSC).

You can access the latest versions of the standards, guidance documents, and compliance resources directly on their website.

These resources include:

• The full PCI DSS framework

• Self-Assessment Questionnaires (SAQs)

• Guidance for merchants and service providers

• Security best practice documents

Many businesses choose to work with a PCI compliance partner to simplify the process and ensure they meet the correct requirements.

PCI compliance levels are based on the number of card transactions a business processes each year. These levels determine the validation requirements needed to demonstrate compliance.

The four merchant levels are:

Level 1

• More than 6 million transactions per year

• Requires an annual on-site assessment by a Qualified Security Assessor (QSA)

• Quarterly network vulnerability scans

Level 2

• 1 to 6 million transactions per year

• Annual Self-Assessment Questionnaire (SAQ)

• Quarterly vulnerability scans

Level 3

• 20,000 to 1 million e-commerce transactions annually

• SAQ validation and vulnerability scans

Level 4

• Fewer than 20,000 e-commerce transactions per year, or up to 1 million total transactions annually

• SAQ completion, with scans where required

Your acquiring bank or payment provider will normally determine your merchant level.

If your business operates across multiple locations and each location accepts card payments, PCI DSS security requirements still apply.

How compliance is validated depends on your payment infrastructure.

For example:

• Locations using separate payment systems may need to validate compliance individually.

• Businesses using a centralised payment environment may be able to validate all locations under a single assessment.

• Some organisations include all sites within one compliance scope depending on how card data flows through the business.

The key requirement is that any environment handling cardholder data must be secured and compliant with PCI DSS standards.