PCI DSS
Also called PCI compliance, Payment Card Industry Data Security Standard
PCI DSS is the security standard that governs how card data is handled, set by the card schemes rather than by law. Any business accepting card payments must comply, though the burden is small if the business never touches card numbers directly.
Compliance is proved by a Self-Assessment Questionnaire, and which questionnaire you complete depends on how card data reaches you.
If payments are taken through a compliant terminal or a hosted checkout, the card number never enters your systems and the shortest questionnaire applies.
The picture changes entirely if staff write card numbers on paper or type them into your own system. That pulls your whole environment into scope.
Many providers charge a monthly PCI compliance fee, and some charge a non-compliance penalty if the questionnaire is not returned.
Why it matters to you
Never write a card number down. It is the single decision that keeps your compliance obligations trivial, and it costs nothing.
Work out what you’re actually paying.
Whatever your statement calls it, the only figure that matters is total cost divided by total takings. Our calculator works that out from your own numbers.
Open the calculator