PCI DSS: How your business can stay compliant

PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that every company accepting, processing, storing, or transmitting credit card information maintains a secure environment.

PCI DSS was established in 2004 by the major card brands (Visa, Mastercard, American Express, Discover, and JCB).

Key concepts of PCI compliance

To understand the PCI DSS better, it’s helpful to be familiar with a few core components:

• The PCI Security Standards Council (PCI SSC): This independent body manages and updates the standards, while individual card brands and payment processors handle enforcement.

• Scope: Any system, network, or server that touches or can impact the security of cardholder data is considered in scope.

• Validation: To prove compliance, you must submit validation documents annually. This is done either through a Self-Assessment Questionnaire (SAQ) or a formal Report on Compliance (ROC) audited by a Qualified Security Assessor (QSA). Understanding these validation steps is the first step toward achieving your PCI DSS compliance certification.

For example, a subscription brand must ensure its billing databases never store sensitive authentication data like full CVV codes. Keeping this data out of your environment keeps your systems secure and limits your audit scope.

PCI DSS requirements apply to any business that handles cardholder data, including accepting, processing, storing, or transmitting cardholder or sensitive authentication data. If your business accepts credit or debit card payments, you must comply.

Cardholder data refers to:

• Primary Account Number (PAN): This is the credit card number.

• Cardholder details: These include the cardholder's name, expiration date, and service code.

• Sensitive Authentication Data (SAD): This includes magnetic stripe data, chip data, and CVV codes, which must never be stored after authorisation.

Whether you run a local boutique or a global enterprise, your systems must meet these security standards if cards are accepted as a payment method.

PCI DSS compliance works in three steps:

• Assess: Map your entire payment flow to spot where cardholder data is processed, stored, or transmitted.

• Remediate: Fix vulnerabilities, eliminate unnecessary storage of cardholder data, and secure your systems using tools like network segmentation or tokenisation.

• Report: Compile and submit validation documents (like an SAQ or ROC) to your acquiring bank and payment networks.

The PCI DSS framework consists of 12 core requirements, structured under six broader security goals. Here is a PCI DSS compliance checklist:

Goal 1: Build and maintain a secure network

• Requirement 1: Install and maintain network security controls (such as firewalls).

• Requirement 2: Apply secure configurations to all system components (never use vendor default passwords).

Goal 2: Protect cardholder data

• Requirement 3: Protect stored cardholder data (use encryption).

• Requirement 4: Encrypt cardholder data during transmission across public networks.

Goal 3: Maintain a vulnerability management program

• Requirement 5: Protect all systems against malware and update antivirus software regularly.

• Requirement 6: Develop and maintain secure systems and applications.

Goal 4: Implement strong access control measures

• Requirement 7: Restrict access to cardholder data to only those who need it for business.

• Requirement 8: Spot users and authenticate system access (always use multi-factor authentication).

• Requirement 9: Restrict physical access to cardholder data.

Goal 5: Regularly monitor and test networks

• Requirement 10: Log and monitor all access to network resources and cardholder data.

• Requirement 11: Test the security of systems and networks regularly.

Goal 6: Maintain an information security policy

• Requirement 12: Maintain a comprehensive information security policy for all personnel.

Your validation process depends on your merchant level, which is decided by your annual transaction volume:

Looking Ahead: As payment standards evolve, businesses must prepare for the latest criteria, such as PCI DSS v4 compliance, which introduces new requirements for flexibility and continuous monitoring.

The cost of PCI compliance varies depending on your business size, transaction volume, and the specific security measures you implement. 

Some payment processors may charge PCI compliance fees as a monthly fee for maintaining compliance tools. They may also charge penalties for non-compliance.

Other providers, like Adyen, bundle compliance support into their standard offering to reduce additional costs. 

PCI compliance is an essential investment to protect your business. You can avoid unexpected fees by confirming what your current provider includes in their service.

Adyen handles most PCI DSS requirements for you, so your business can focus on growth while minimising the complexity of managing sensitive cardholder data.

Our solutions simplify  compliance by offering secure PCI DSS compliance services and PCI DSS compliance software integrations that minimise your compliance burden while ensuring safe payment processing. 

Here’s how Adyen’s key integrations work to reduce your PCI DSS scope:

• Drop-in components and plugins: These pre-built integrations manage payment data securely on our servers, so you don't have to worry about storing or handling sensitive card information.

• Pay by Link: Simply send secure payment links to your customers, allowing them to complete their purchase on a secure page hosted by Adyen.

• Hosted checkout: Use our fully customisable, secure payment page to handle and store cardholder information.

• In-person payments (IPP): Our secure card terminals encrypt information instantly, so you don't have to worry about managing complex security requirements for your in-store transactions.

These integrations significantly reduce your PCI DSS compliance scope. They let your business process payments securely without the complexity of handling or storing sensitive cardholder data. 

Comprehensive documentation and ongoing support

We have dedicated  resources to help businesses understand and maintain PCI DSS compliance. Check out the key requirements and best practices in our PCI DSS Compliance Guide.

Ready to streamline your payment security?

Get in touch to find the best integration to cut your PCI scope, protect your brand, and lower administrative friction.

The PCI Security Standards Council sets the standard, and the card schemes enforce it through your acquirer, so your acquirer decides how you validate and by when. Ask them which Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC) they expect from you.

If you hold Cyber Essentials, the UK government-backed scheme, it doesn’t replace PCI DSS, but it overlaps with some of its requirements, so you may already have a head start.

PCI DSS is the same for UK and Irish merchants, but the data protection regulator you answer to differs. If a breach exposes card data, the Information Commissioner’s Office (ICO) enforces UK GDPR in the UK, and the Data Protection Commission enforces EU GDPR in Ireland. Under both, you must report a qualifying personal data breach within 72 hours of becoming aware of it. Using a provider like Adyen that keeps card data off your systems gives you less to protect.