Quick answer
PCI DSS (Payment Card Industry Data Security Standard) is a set of technical and operational requirements for protecting payment card data[1]. It applies to any organisation that stores, processes or transmits cardholder data. It is written by the PCI Security Standards Council, but card brands and acquirers enforce it[2].
Key points
- PCI DSS is an industry standard, not a law; it is enforced through card brand rules and merchants' contracts with their acquirers.
- It has 12 principal requirements grouped under six goals, from network security to written security policies.
- The current version is PCI DSS v4.0.1, published in June 2024; requirements that were future-dated became effective on 31 March 2025.
- Some card data, such as the full magnetic stripe data, the security code and the PIN, must never be stored after authorisation.
- How a merchant proves compliance depends on its 'level', which Visa sets by annual transaction volume.
On this page
#What problem does PCI DSS solve?
A card number is valuable to criminals because it can be used to buy things online. Every shop, payment provider and bank that touches card numbers is a possible leak. The Payment Card Industry Data Security Standard (PCI DSS) sets one shared baseline of technical and operational requirements designed to protect payment account data[1]. Without it, each card brand would publish its own rules and every merchant would face several overlapping checklists.
The standard applies to entities that store, process or transmit cardholder data or sensitive authentication data, or that could affect the security of the environment where that data lives. The PCI Security Standards Council (PCI SSC) says this covers everyone involved in card processing: merchants, processors, acquirers, issuers and service providers[1]. If you are new to who these parties are, read how card payments work first.
#Who writes PCI DSS and who enforces it?
The PCI SSC writes and maintains the standard. The Council's 2021 overview says it is led by an Executive Committee with representatives of American Express, Discover, JCB International, Mastercard, UnionPay and Visa[2]. Crucially, the Council does not police anyone. In its own words, enforcement of compliance and any penalties for non-compliance are carried out by the individual payment brands, not by the PCI SSC, and each brand's rules are adopted and implemented by the acquiring banks[2].
That is why a small shop usually hears about PCI DSS from its payment provider rather than from a regulator. Visa, for example, states that acquirers are responsible for ensuring that all their merchants comply with PCI data security requirements[3].
#What are the 12 requirements of PCI DSS?
PCI DSS v4 groups its 12 principal requirements under six goals. The titles below are copied from the PCI SSC's own self-assessment questionnaire for merchants[4]. Each requirement contains many detailed sub-requirements and testing procedures.
| Goal | Requirements |
|---|---|
| Build and Maintain a Secure Network and Systems | 1. Install and Maintain Network Security Controls · 2. Apply Secure Configurations to All System Components |
| Protect Account Data | 3. Protect Stored Account Data · 4. Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks |
| Maintain a Vulnerability Management Program | 5. Protect All Systems and Networks from Malicious Software · 6. Develop and Maintain Secure Systems and Software |
| Implement Strong Access Control Measures | 7. Restrict Access to System Components and Cardholder Data by Business Need to Know · 8. Identify Users and Authenticate Access to System Components · 9. Restrict Physical Access to Cardholder Data |
| Regularly Monitor and Test Networks | 10. Log and Monitor All Access to System Components and Cardholder Data · 11. Test Security of Systems and Networks Regularly |
| Maintain an Information Security Policy | 12. Support Information Security with Organizational Policies and Programs |
Source: PCI DSS v4.0 Self-Assessment Questionnaire D for Merchants (April 2022).
#Which card data can a business keep, and which must it never store?
PCI SSC guidance says the cardholder name, primary account number (PAN, the long card number), expiry date and service code may be stored as long as they are protected. It also says that the full magnetic stripe or track data, the card verification code (the three or four digits often called CVV2 or CVC2) and the PIN or PIN block must never be stored after authorisation, and that the PAN must be rendered unreadable wherever it is stored, for example by hashing, truncation, tokenization or strong cryptography[5].
Many businesses avoid storing card numbers at all. Tokenization replaces the PAN with a surrogate value called a token; PCI SSC guidance says it does not eliminate the need to maintain and validate compliance but may simplify validation by reducing the number of systems the requirements apply to[6]. See our glossary entry on tokenization.
#What changed with PCI DSS version 4?
Recent PCI DSS milestones
March 2022
PCI DSS v4.0 is published[7].
31 March 2024
PCI DSS v3.2.1 is retired[8].
11 June 2024
PCI DSS v4.0.1, a limited revision with no added or deleted requirements, is published[7].
31 December 2024
PCI DSS v4.0 is retired, leaving v4.0.1[7].
31 March 2025
Requirements that had been future-dated in v4 become effective; 51 of the 64 new requirements fell into this group[8].
#How does a merchant prove it complies?
Proof depends on size. Visa groups merchants into four levels by the number of Visa transactions they process each year[3]. Level 1 merchants need an annual Report on Compliance by a Qualified Security Assessor (an approved auditor); levels 2 and 3 complete an annual Self-Assessment Questionnaire (SAQ); and for level 4, the acquirer sets the validation requirements[3]. Other card brands run their own programmes, so always check with your acquirer.
| Level | Annual Visa transactions | Main validation |
|---|---|---|
| 1 | Over 6 million (all channels) | Report on Compliance by a Qualified Security Assessor |
| 2 | 1 million to 6 million (all channels) | Self-Assessment Questionnaire |
| 3 | 20,000 to 1 million e-commerce | Self-Assessment Questionnaire |
| 4 | Fewer than 20,000 e-commerce, and other merchants with up to 1 million | Set by the acquirer |
Source: Visa compliance validation page[3]. Levels 1 to 3 also list quarterly network scans by an Approved Scanning Vendor.
Worked example
Worked example: which Visa level is a shop?
Two simplified shops, using only Visa's published thresholds. Monthly averages were computed with code.
- Online shop with 25,000 Visa e-commerce transactions a year (about 2,083 a month)
- Between 20,000 and 1 million e-commerce: Level 3
- Retail chain with 2.5 million Visa transactions a year across all channels (about 208,333 a month)
- Between 1 million and 6 million: Level 2
- Share of new v4 requirements that were future-dated
- 51 ÷ 64 ≈ 79.7%
Common beginner mistakes about PCI DSS
Thinking PCI DSS is a law
It is an industry standard enforced through card brand rules and acquirer contracts, not by a government regulator.
Storing the card security code 'for convenience'
The CVV2/CVC2 code must never be stored after authorisation, according to PCI SSC guidance.
Believing a payment provider makes you fully compliant
Tools such as tokenization can shrink the parts of your business in scope, but PCI SSC guidance says you still have to maintain and validate compliance.
Assuming small shops are exempt
Every merchant that accepts cards falls under the standard; smaller ones simply validate in a lighter way.
The bottom line
PCI DSS is the shared security rulebook for anyone who handles card data, written by a council of card brands and enforced through acquirers. Its 12 requirements cover networks, stored data, access, monitoring and policy, and version 4.0.1 is now the only live version. For consumers, its practical effect is that well-run businesses never keep your card's security code and increasingly never see your real card number at all.
Frequently asked questions
Is PCI DSS compliance required by law?
Not as such. The PCI SSC writes the standard, while enforcement and penalties are handled by the payment brands and implemented through acquirers[2].
What is the latest version of PCI DSS?
PCI DSS v4.0.1, published in June 2024; v4.0 was retired on 31 December 2024[7].
Can a shop keep my CVV for next time?
No. PCI SSC guidance lists the card verification code among data that must never be stored after authorisation[5].
Does tokenization remove the need for PCI DSS?
No. It can reduce the number of systems in scope, but compliance must still be maintained and validated[6].
Sources
- PCI DSS (standard overview page) — PCI Security Standards Council, 2026 Primary
- At a Glance: Role of the PCI Security Standards Council — PCI Security Standards Council, 2021 Primary
- Validation of Compliance (merchant levels) — Visa, 2026 Primary
- PCI DSS v4.0 Self-Assessment Questionnaire D for Merchants — PCI Security Standards Council, 2022 Primary
- At a Glance: PCI Data Storage Do's and Don'ts — PCI Security Standards Council, 2008 Primary
- Information Supplement: PCI DSS Tokenization Guidelines (v2.0) — PCI Security Standards Council, 2011 Primary
- Just Published: PCI DSS v4.0.1 — PCI Security Standards Council, 2024 Primary
- Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x — PCI Security Standards Council, 2024 Primary
- Fraud remains a national security threat as criminals steal almost £1.3 billion (Annual Fraud Report 2026 press release) — UK Finance, 2026
