{"head":{"title":"When Do I Need PCI DSS? Card Data Rules for Software","description":"You need PCI DSS whenever you store, process or send card data, or can affect its security. How hosted payment pages shrink scope, and what v4.x changed.","canonical":"https://oceanlab.in/questions/when-do-i-need-pci-dss"},"crumbs":[{"name":"Home","path":"/"},{"name":"Questions","path":"/questions"},{"name":"When do I need PCI DSS?","path":"/questions/when-do-i-need-pci-dss"}],"question":"When do I need PCI DSS?","answer":["Whenever your business stores, processes or transmits payment card data, or runs systems that could affect the security of that data. Almost every business that takes card payments has some PCI DSS duty; the question is how much, and good design can make it small."],"sections":[{"heading":"Scope is the real question","body":[["PCI DSS applies to the ",{"href":"/glossary/cardholder-data-environment","text":"cardholder data environment"},": the people, processes and systems that handle card data, and anything connected to them. Your acquiring bank or payment provider tells you which validation you need, often a self-assessment questionnaire (SAQ) for smaller merchants."],["If card numbers never touch your servers, because customers type them into a payment provider's hosted page, iframe or SDK, your scope and paperwork shrink a lot. You still have duties, for example for the page that loads the payment form."]],"bullets":[]},{"heading":"Design choices that keep scope small","body":[],"bullets":[["Use a hosted payment page or provider-hosted fields so raw card numbers go straight to the provider."],["Store only provider tokens, never card numbers, and never log full card data or security codes."],["Separate any system that does touch card data from the rest of the network."],["Control and monitor the scripts on your payment pages, since attackers target them to skim cards."],["Keep a list of every vendor in the payment flow and their PCI status."]]},{"heading":"What changed with PCI DSS v4.x","body":[["PCI DSS v4.0 added 64 new requirements, and 51 of them were future-dated until 31 March 2025. They now apply. Two of them, requirements 6.4.3 and 11.6.1, target e-skimming: scripts on payment pages must be authorised, checked for integrity and monitored for tampering. The PCI SSC has since removed them from SAQ A, the shortest questionnaire for merchants that fully outsource card entry, so which ones apply to you depends on your integration."]],"bullets":[]}],"faqs":[{"question":"We use Stripe or a similar provider. Are we exempt?","answer":"No, but your scope is much smaller. You still confirm compliance, usually with a short SAQ, and keep your payment page and integration secure."},{"question":"Is PCI DSS a law?","answer":"It is an industry standard enforced through contracts with card brands, acquirers and payment providers, not a government law. Some laws refer to it."},{"question":"Can we store card numbers to make repeat payments easy?","answer":"Use the provider's tokens or saved payment methods instead. Storing card numbers yourself brings your systems fully into scope."}],"terms":[{"href":"/glossary/cardholder-data-environment","label":"cardholder data environment"},{"href":"/glossary/maker-checker","label":"maker-checker"},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II"}],"tools":[{"href":"/tools/pci-dss-saq-picker","label":"PCI DSS SAQ picker","detail":"Free tool"},{"href":"/tools/payment-processing-fee-calculator","label":"Payment processing fee calculator","detail":"Free tool"},{"href":"/tools/fintech-app-cost","label":"Fintech app cost","detail":"Free tool"}],"links":[{"href":"/compliance/pci-dss","label":"PCI DSS guide","detail":"Card data rules and how to shrink your scope."},{"href":"/glossary/saq","label":"SAQ (self-assessment questionnaire)","detail":"Glossary"},{"href":"/glossary/pci-scope","label":"PCI scope","detail":"Glossary"},{"href":"/glossary/tokenization","label":"Tokenization","detail":"Glossary"},{"href":"/software/payments","label":"Software for payments","detail":"Payment systems and the compliance work they bring."}],"related":[{"href":"/questions/how-much-does-a-fintech-app-cost","label":"How much does a fintech app cost?","detail":"Question"},{"href":"/questions/kyc-vs-kyb","label":"What is the difference between KYC and KYB?","detail":"Question"},{"href":"/questions/what-is-dora-for-fintech","label":"What is DORA for fintech?","detail":"Question"},{"href":"/compare/ai-agent-vs-workflow-automation","label":"AI agent vs workflow automation","detail":"Comparison"},{"href":"/compare/rag-vs-fine-tuning","label":"RAG vs fine-tuning","detail":"Comparison"},{"href":"/glossary","label":"Glossary","detail":"Every term, in plain words."}],"sources":[{"title":"PCI Security Standards Council, PCI DSS","url":"https://www.pcisecuritystandards.org/standards/pci-dss/","checkedAt":"2026-10-25"},{"title":"PCI SSC blog: adopting the future-dated requirements of PCI DSS v4.x","url":"https://blog.pcisecuritystandards.org/now-is-the-time-for-organizations-to-adopt-the-future-dated-requirements-of-pci-dss-v4-x","checkedAt":"2026-10-25"},{"title":"PCI SSC blog: guidance for PCI DSS e-commerce requirements effective after 31 March 2025","url":"https://blog.pcisecuritystandards.org/coffee-with-the-council-podcast-guidance-for-pci-dss-e-commerce-requirements-effective-after-31-march-2025","checkedAt":"2026-10-25"},{"title":"PCI SSC document library (PCI DSS and SAQs)","url":"https://www.pcisecuritystandards.org/document_library/","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}