PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to protect cardholder data.
If your business accepts, processes, stores, or transmits card payments, PCI compliance applies to you.
Below are 10 essential facts every organisation should understand.
Key Takeaways
- PCI DSS applies to any business handling card payments
- Compliance requirements vary by transaction volume
- Non-compliance can lead to fines, penalties, and reputational damage
- Annual validation and ongoing security checks are required
- Using third-party providers can reduce compliance scope
- Responsibility for data security always remains with the business
1. There Are Different Levels of PCI Compliance
Organisations are classified into different PCI compliance levels based on the number of card transactions they process annually.
These levels include:
- Level 1: Merchants processing over 6 million transactions per year
- Level 2: Between 1 and 6 million transactions per year
- Level 3: Between 20,000 and 1 million transactions per year
- Level 4: Fewer than 20,000 transactions per year
Your compliance level determines the validation requirements your organisation must meet. The higher your level, the stricter the validation process.
Many businesses underestimate their level, which can lead to under-compliance.
2. Non-Compliance Can Have Significant Consequences
If organisations fail to properly collect, process, store, or transmit sensitive card data, they significantly increase their risk of a data breach.
This can lead to:
- Substantial financial penalties
- Increased transaction fees
- Loss of the ability to accept card payments
- Costly forensic investigations
- Reputational damage and negative publicity
- Compensation claims from affected customers
Following the introduction of the General Data Protection Regulation (GDPR), the financial and legal impact of data breaches has become even more severe.
Achieving PCI compliance helps reduce risk and protect both your business and your customers.
3. Compliance Must Be Proven, Not Assumed
All PCI-compliant organisations must be able to demonstrate that they are following the required security standards.
The exact requirements depend on your merchant level. However, all organisations are expected to:
- Complete an Attestation of Compliance (AOC)
- Conduct quarterly network scans through an Approved Scanning Vendor (ASV)
Additional validation requirements apply depending on your level:
- Level 1 organisations: Must complete an annual Report on Compliance (ROC) – a detailed on-site assessment carried out by an independent Qualified Security Assessor (QSA)
- Levels 2–4 organisations: Must complete an annual Self-Assessment Questionnaire (SAQ), which evaluates their security controls and payment processes
PCI compliance is not a one-time certification, it requires continuous validation and ongoing adherence to security standards.
4. An Attestation of Compliance Must Be Completed and Signed
The Attestation of Compliance (AOC) is a formal document confirming that your organisation meets PCI DSS requirements.
It must be completed by the individual responsible for compliance within your organisation, such as:
- Chief Financial Officer (CFO)
- Head of Compliance
- Security or Risk Lead
Different versions of the AOC exist depending on the scope of your business. However, in all cases, it certifies that the relevant PCI requirements have been met.
The AOC represents a formal declaration of compliance responsibility.
5. Level 1 Organisations Must Be Assessed by a QSA
If your organisation falls under Level 1, compliance must be verified by a Qualified Security Assessor (QSA).
QSAs are independent security organisations that are certified by the PCI Security Standards Council to assess and validate adherence to PCI DSS requirements.
An up-to-date list of QSAs is available on the PCI Security Standards Council website.
6. Different Businesses Require Different SAQs
Self-Assessment Questionnaires (SAQs) are completed by organisations to evaluate their compliance with PCI DSS requirements.
They vary depending on:
- How payments are processed
- The type of business
- The technology and infrastructure used
Each SAQ contains a set of questions designed to assess the security of your payment environment.
For Level 1 organisations and service providers, this process differs, as validation must be conducted by an independent QSA.
Selecting the correct SAQ is essential for accurate compliance.
7. PCI-Certified Software Does Not Guarantee Compliance
Payment applications that are PA-DSS certified have been tested to meet PCI security standards.
However, using compliant software does not mean your organisation is fully PCI compliant.
This is because:
- PCI DSS applies to your entire environment
- Internal processes and data handling must also meet requirements
- PA-DSS certification applies only to software, not services or infrastructure
Organisations remain responsible for ensuring full compliance across their systems.
8. Outsourcing Can Simplify PCI Compliance
Working with a Level 1 PCI DSS payment service provider can significantly reduce the complexity of compliance.
Benefits include:
- Reduced exposure to cardholder data
- Lower operational and technical burden
- Simplified compliance requirements
Achieving PCI compliance independently can be complex and resource-intensive. By outsourcing and reducing (descoping) your payment environment, you can minimise the systems that fall under PCI DSS.
For example:
- A Self-Assessment Questionnaire (SAQ) may be reduced from over 200 detailed requirements to around 13 simple yes/no questions
This approach helps organisations streamline compliance while improving security.
9. Outsourcing Does Not Remove Your Responsibility
Even when using a PCI-compliant third-party provider, your organisation remains responsible for protecting cardholder data.
You are still required to:
- Complete an annual Attestation of Compliance (AOC)
- Conduct quarterly network scans
- Ensure secure handling of data within your environment
Selecting a reliable Level 1 provider with the right expertise is essential to maintaining compliance and reducing risk.
10. PCI Compliance Is an Ongoing Requirement
As more organisations move towards digital payment systems, the risk of cybercrime continues to increase.
Attackers are constantly developing new methods to access sensitive data, making strong security standards essential.
By following PCI DSS requirements, organisations can significantly reduce their exposure to data breaches and fraud.
PCI compliance is not a temporary obligation, it is a continuous process that must evolve alongside emerging threats.
