PCI DSS

Payment Card Industry Data Security Standard

In plain language

The rulebook that card companies require from any business that takes card payments.

The metaphor

Like a food safety code for restaurants: each kitchen follows it so no customer is harmed.

Going deeper

How it works

It covers how card data is stored, sent and protected.
Smaller businesses answer a yearly questionnaire based on how they take cards.
Using a payment processor that handles card data for you reduces the work.
Never store card numbers in email or spreadsheets.

What can go wrong (example scenario)

A boutique wrote customers' card numbers in a spreadsheet for phone orders. A stolen laptop meant a card data incident and a call to the payment processor.

In practice

A shop uses a card terminal that never shows the number to staff.
A restaurant keeps its terminal on a separate network.
An online store uses a hosted payment page.

A question owners ask

Where do I start?

Ask your payment processor which questionnaire applies to you and what they handle for you.

Related terms

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →