Also called: Payment Card Industry Data Security Standard, PCI Data Security Standard, PCI, PCI compliance, PCI-DSS
What PCI DSS is
PCI DSS stands for Payment Card Industry Data Security Standard. It sets technical and operational requirements to protect payment account data. The standard applies to any entity that stores, processes, or transmits cardholder data, including businesses that outsource payment processing.
The requirements cover 12 areas grouped into six goals: secure networks, protect card data, manage vulnerabilities, control access, monitor and test systems, and maintain an information security policy. Examples include using unique user IDs, restricting access by business need, tracking access to card data, and encrypting data sent across public networks.
Outsourcing card processing can reduce your PCI scope, but it does not erase your responsibility to validate compliance.
How your payment setup affects the work
Your responsibilities depend on how card data reaches your payment provider. If your systems store, process, or transmit the data, those systems are in scope. Using a hosted payment page or tokenized fields can reduce which parts of your environment touch card data, but does not automatically remove your validation duties.
If you outsource all payment processing and do not handle cardholder data yourself, many technical requirements may not apply directly to your environment. You still need to validate your compliance, understand the division of responsibilities, keep a written agreement that assigns the provider’s responsibilities under Requirement 12.8.2, and monitor the provider’s compliance at least annually under Requirement 12.8.4. Merchants commonly complete a Self-Assessment Questionnaire, or SAQ, to validate.
What it means for your costs
PCI DSS does not set one standard fee for merchants. Your acquiring bank or payment provider can bill a recurring PCI non-compliance fee if you miss required validation, such as an SAQ deadline. The charge is tied to your account terms and can continue each billing cycle until you submit the required proof.
A PCI fee on your statement does not prove that your business is compliant. Separate a charge for compliance services from a non-compliance charge, then confirm what action and documentation the charge relates to. Completing validation does not guarantee security, but an uncompleted form can cost you even when no data breach has occurred.
What changed in the current standard
PCI DSS v4.0.1 is the current version as of 2026. The 51 future-dated requirements from v4.0 became mandatory on March 31, 2025. They include controls for scripts on e-commerce payment pages, under Requirements 6.4.3 and 11.6.1, and multi-factor authentication for all access into the cardholder data environment.
If your checkout page loads payment scripts, or staff and vendors can access systems that handle card data, confirm that those systems and access paths are covered by your validation. These details matter even when a third party hosts your checkout.
What you can actually change
- Identify your scope. Map where card data enters, moves through, or is stored in your business. Ask your payment provider to document which requirements it handles and which remain yours.
- Complete validation. Find the required SAQ and due date for your payment setup. Submit the completed validation and any required scans or attestations to the organization managing your compliance program.
- Review the fee line. Look for PCI compliance or PCI non-compliance charges on your processing statement. Match each charge to a service or an outstanding validation requirement, and check that it stops after you submit proof.
- Reduce card-data exposure. Use hosted payment fields or tokenization where they fit your checkout. They can reduce the systems in scope, but you must still complete the validation required for your setup.
Frequently asked questions
Do I need PCI DSS compliance if I outsource all card processing?
Yes. Outsourcing can reduce the requirements that apply directly to your systems, but it does not remove your responsibility to validate compliance. You must also understand shared responsibilities, keep a written agreement defining the provider’s role, and monitor the provider’s compliance at least annually.
Does paying a PCI non-compliance fee make my business compliant?
No. A fee is a charge, not proof of compliance. You must complete the validation required for your payment setup, such as the applicable Self-Assessment Questionnaire, and submit the required documentation.
What is the current version of PCI DSS?
PCI DSS v4.0.1 is the current version as of 2026. The 51 future-dated requirements from v4.0 became mandatory on March 31, 2025, including e-commerce payment-page script controls and multi-factor authentication for access to the cardholder data environment.
Can a hosted payment page reduce my PCI responsibilities?
Yes, a hosted page can reduce which systems in your business handle card data and therefore reduce your scope. It does not eliminate your responsibility to validate compliance or to confirm that the provider’s services and your own responsibilities are clearly documented.