PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to protect cardholder data. It applies to any business that stores, processes, or transmits credit or debit card information.

The standard was created by the Payment Card Industry Security Standards Council (PCI SSC) and is supported by major card brands such as Visa, Mastercard, American Express, Discover, and JCB.

PCI DSS outlines security requirements that help businesses:

• Protect customer payment data

• Reduce the risk of data breaches

• Maintain secure payment systems

• Build trust with customers

If your business accepts card payments in any form (online, over the phone, or in person), PCI DSS applies to you.

The official PCI DSS standards are published by the Payment Card Industry Security Standards Council (PCI SSC).

You can find the full documentation, guidance papers, and compliance resources on their website:

www.pcisecuritystandards.org

The site includes:

• The latest PCI DSS standard documentation

• Self-Assessment Questionnaires (SAQs)

• Compliance guides for different industries

• Security best practices for protecting cardholder data

Many businesses work with a PCI compliance provider who helps interpret these requirements and ensures the correct compliance process is followed.

PCI compliance levels are determined by how many card transactions your business processes each year.

The four levels are:

Level 1

• Over 6 million transactions annually

• Requires a Qualified Security Assessor (QSA) audit

• Annual on-site assessment and network scans

Level 2

• 1 to 6 million transactions annually

• Self-Assessment Questionnaire (SAQ)

• Quarterly network scans

Level 3

• 20,000 to 1 million e-commerce transactions annually

• SAQ validation

• Quarterly vulnerability scans

Level 4

• Fewer than 20,000 e-commerce transactions annually or up to 1 million total transactions

• SAQ completion

• May require quarterly scans depending on card provider

Your payment provider or acquiring bank typically determines your compliance level.

Generally, yes. If multiple locations process card payments, each location must follow PCI DSS security requirements.

However, how compliance is validated depends on how your payment systems are set up.

For example:

• If each site has separate payment systems, they may need to validate compliance individually.

• If locations are connected through a centralised payment platform, compliance may be managed at the organisational level.

• Some businesses can include all sites within one PCI assessment, depending on their infrastructure.

The key requirement is that every environment handling card data must be secured and compliant.