PCI DSS
Definition
PCI DSS is the data security standard of the card payment industry for all entities that store, process, or transmit cardholder data.
PCI DSS is a data security standard for handling payment card data. It includes technical and operational requirements for systems that contain or are associated with cardholder data, such as protecting card numbers, authentication, and integration of service providers.
Simply explained
Like the house rules of a vault room: Whoever stores, processes, or passes on card data must comply with established rules.
Why it matters in practice
PCI DSS concerns the handling of payment card data, for example in online shops and point-of-sale systems. What matters is which own or connected components process such data.
Example from business
Possible example (hypothetical): An online retailer integrates a hosted payment form from its payment service provider with the goal that card numbers do not pass through its own servers.
Limits and pitfalls
- A payment service provider does not automatically assume all obligations. Data flows and storage locations must be known; outdated standard versions are insufficient. Requirements should be clarified with the responsible bank or card brand.
Origin & history
The PCI Security Standards Council was founded by the major card brands. PCI DSS 4.0 was released in March 2022; 4.0.1 followed in June 2024 as a limited revision without new or removed requirements.
Use in mid-sized companies
- Possible applications: Planning online shops, selecting payment service providers, securing point-of-sale systems, reviewing service provider contracts.
Frequently asked questions
Is PCI DSS a law?
No, it is an industry standard enforced by the participating card brands according to a 2010 overview.
Does it also apply to small shops?
The overview mentions companies of all sizes that accept cards or store, process, or transmit cardholder data.
What changed in 4.0.1?
The revision corrected and clarified version 4.0 without adding or removing requirements.
Sources
- Just Published: PCI DSS v4.0.1 · PCI Security Standards Council (2024): Just Published: PCI DSS v4.0.1
- Standards Overview · PCI Security Standards Council (2010): Standards Overview
Sources checked on 14.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: