The PCI DSS is a set of rules that card networks require merchants and payment processors to follow to keep your card data safe

The Payment Card Industry Data Security Standard (PCI DSS) is not a law passed by Congress or a regulation written by a federal agency. It is a rulebook created and enforced by the major card networks—Visa, Mastercard, American Express, Discover, and others—that applies to anyone who accepts, stores, or processes credit and debit card information. If a business takes your card number, they must follow PCI DSS rules or face fines, loss of card-processing privileges, or both.

The standard covers how businesses must handle your card data from the moment you hand over your number until they delete it. It sets requirements for network security, employee access controls, encryption, fraud monitoring, and incident response. The goal is to make it harder for thieves to steal card information during a transaction or from a business's files. When a major data breach happens—Target, Home Depot, Equifax—one of the first questions investigators ask is whether the company was following PCI DSS rules.

Key Takeaways

  • PCI DSS is enforced by card networks, not government agencies, and applies to any business that accepts or stores card data.
  • The standard requires encryption of card data in transit and at rest, restricted employee access, regular security testing, and documented incident response plans.
  • Businesses that process large volumes of transactions face stricter compliance requirements and more frequent audits than small merchants.
  • A PCI DSS violation can result in fines from card networks, mandatory security upgrades, or suspension of card-processing ability.
  • PCI DSS protects your card data while it is in a business's hands, but does not cover fraud that happens after your card is stolen or used without permission.

Who has to follow PCI DSS and why

Any organization that accepts, transmits, or stores credit or debit card data must follow PCI DSS. This includes retail stores, restaurants, gas stations, online merchants, payment processors, banks, and even charities that take donations by card. The card networks—Visa, Mastercard, American Express, Discover, JCB, and UnionPay—created the standard together and require their member banks to enforce it.

The reason is straightforward: card networks want to reduce fraud and data theft because both cost them money. When a card is compromised, the network and the issuing bank often absorb the loss. A business that fails to protect card data creates liability for the entire system. So the networks use PCI DSS as a baseline security requirement and audit businesses to confirm they are following it.

What PCI DSS actually requires

The standard has six main categories of requirements. First, businesses must build and maintain a secure network—firewalls, intrusion detection, and network segmentation so that card data is isolated from other systems. Second, they must protect card data itself, usually through encryption, so that even if a thief steals the data, they cannot read it without a decryption key.

Third, businesses must maintain a vulnerability management program: regular security scans, patching software, and removing unnecessary software from systems that handle card data. Fourth, they must control who can access card data—employees should only see the data they need to do their job, and access must be logged and reviewed. Fifth, they must monitor and test their networks regularly to catch unauthorized access or suspicious activity. Sixth, they must have a written information security policy and an incident response plan that describes what to do if a breach occurs.

The standard also requires businesses to work only with vendors and service providers who are themselves PCI DSS compliant. If a payment processor or cloud storage company handles your card data, that company must meet the same standards.

Compliance levels and what they mean for you

PCI DSS divides businesses into four compliance levels based on how many card transactions they process per year. The thresholds vary slightly by card network, but the general structure is the same. Level 1 merchants process over 6 million transactions annually and face the strictest requirements: annual third-party audits, quarterly network scans, and detailed documentation. Level 4 merchants process fewer than 20,000 transactions and may only need to complete a self-assessment questionnaire once a year.

A small business that takes a few hundred card payments a month will likely fall into Level 4 and have lower compliance costs. A large retailer or online marketplace will be Level 1 and must hire external auditors and maintain extensive security infrastructure. The reason for the tiered approach is that larger merchants handle more data and pose a larger risk if breached, so they face more rigorous oversight.

For you as a customer, compliance level matters because it affects how thoroughly a business's security is checked. A Level 1 merchant's security is audited by an external firm every year; a Level 4 merchant may audit itself. Neither guarantees your data is safe, but Level 1 merchants have more eyes on their systems.

What happens when a business fails a PCI DSS audit

If a business is found to be out of compliance, the card networks impose fines—usually starting at $5,000 to $10,000 per month and escalating if the violation is not fixed. The business is given a deadline to remediate, meaning they must fix the security gaps and prove they have done so. If they fail to meet the deadline, fines increase and the business may lose the ability to process cards altogether, which is often a death sentence for a retail operation.

In some cases, a business that has been breached is required to hire a may have access to Security Assessor (QSA)—an independent firm certified to audit PCI DSS compliance—to conduct a full assessment and create a remediation plan. This can cost tens of thousands of dollars. The business must also notify cardholders of the breach and may face lawsuits from customers or banks.

What PCI DSS does not protect you from

PCI DSS is a security standard for how businesses handle your card data, but it does not cover everything that can go wrong with your card. If your card is stolen and someone uses it to make unauthorized purchases, PCI DSS did not prevent that—it only made it less likely that a thief stole your number from a business's database. Your card issuer (your bank or credit card company) is responsible for fraud protection, and federal law limits your liability for unauthorized charges to $50 if you report the fraud promptly.

PCI DSS also does not protect you from phishing scams, malware on your own computer, or social engineering attacks where someone tricks you into giving them your card number. It does not cover transactions that happen outside the card network, like wire transfers or peer-to-peer payments. And it does not apply to data breaches at government agencies, healthcare providers, or other organizations that are not part of the card payment system.

How to know if a business is PCI DSS compliant

Most businesses do not advertise their PCI DSS status because compliance is expected, not exceptional. However, you can sometimes find clues. Look for a padlock icon in your browser when you enter payment information on a website—that indicates the connection is encrypted. Check whether the business uses a third-party payment processor like Stripe, Square, or PayPal; these companies are certified PCI DSS compliant and handle the card data on your behalf, so the business itself does not store your full card number.

If you are concerned about a specific business, you can ask them directly whether they are PCI DSS compliant. A legitimate business should be able to tell you yes or no. If they do not know what you are talking about, that is a red flag. You can also check whether a business has been involved in a major breach by searching for it on the Privacy Rights Clearinghouse breach database or the Have I Been Pwned website.

The difference between PCI DSS and other security standards

PCI DSS is specific to payment card data. Other security standards apply to different types of information. HIPAA covers health information, GLBA covers financial information held by banks and insurance companies, and CCPA and GDPR are broader privacy laws that apply to personal data held by any company. A business might need to follow PCI DSS for card payments, HIPAA if it is a healthcare provider, and GDPR if it has customers in Europe.

PCI DSS is also different from state data breach notification laws. Those laws require a business to tell you if your personal information has been stolen. PCI DSS is about preventing the theft in the first place. A business can be PCI DSS compliant and still suffer a breach; the standard reduces risk but does not eliminate it.

Frequently Asked Questions

Does PCI DSS protect me from credit card fraud?

PCI DSS reduces the risk that your card number will be stolen from a business's database, but it does not protect you from fraud that happens after your card is stolen or used without permission. Your card issuer is responsible for fraud protection under federal law, which limits your liability to $50 for unauthorized charges if you report them promptly.

Can I refuse to give my card to a business that is not PCI DSS compliant?

Yes. If a business cannot confirm it is compliant, you can choose not to shop there or ask to pay a different way. However, most businesses that accept cards are compliant because card networks require it. If a business tells you it does not need to be compliant, that is a sign to be cautious.

What should I do if I find out a business I shopped at was breached?

Contact your card issuer and ask them to monitor your account or issue a new card. Check your statements for unauthorized charges. You may also be offered free credit monitoring by the business. If your information was exposed, you can place a fraud alert or credit freeze with the credit bureaus to make it harder for someone to open accounts in your name.

Does PCI DSS apply to online payment apps like Venmo or PayPal?

PayPal and similar services handle card data and must be PCI DSS compliant. However, when you use Venmo to send money to a friend, you are not using a card—you are transferring money from your bank account or Venmo balance, so PCI DSS does not directly apply to that transaction.

Who enforces PCI DSS if a business breaks the rules?

The card networks—Visa, Mastercard, American Express, and others—enforce PCI DSS through the acquiring banks that process payments for merchants. If a business is out of compliance, the acquiring bank is responsible for imposing fines and requiring remediation. The networks can also suspend a business's ability to accept cards.