PCI DSS
The Payment Card Industry Data Security Standard — security requirements for any business handling card data.
PCI DSS is the security standard that governs how card data is stored, processed and transmitted. It is enforced by the card networks through your acquirer rather than by law, but the practical consequences of ignoring it are severe: fines, higher fees, and liability shifted onto you after a breach.
Which requirements apply depends on how you handle card data, expressed as a Self-Assessment Questionnaire type. A merchant whose checkout posts card details to their own server carries a far heavier burden than one using a hosted field or redirect where the data never touches their systems. Choosing the second architecture is the single largest reduction in scope available.
A handful of rules cause most failures. Card verification codes may never be stored after authorization, even encrypted. Full card numbers must be rendered unreadable wherever they are kept. Access must be individual and logged, so shared admin logins are a direct violation.
Compliance is a continuous state, not an annual certificate. Scope creeps quietly when a new integration, CRM export or support tool starts touching card data, and the first time many merchants discover their scope has changed is during a post-breach forensic review.