Questions

When do I need PCI DSS?

Short answer

Whenever your business stores, processes or transmits payment card data, or runs systems that could affect the security of that data. Almost every business that takes card payments has some PCI DSS duty; the question is how much, and good design can make it small.

Last updated 2026-10-25

Scope is the real question

PCI DSS applies to the cardholder data environment: the people, processes and systems that handle card data, and anything connected to them. Your acquiring bank or payment provider tells you which validation you need, often a self-assessment questionnaire (SAQ) for smaller merchants.

If card numbers never touch your servers, because customers type them into a payment provider's hosted page, iframe or SDK, your scope and paperwork shrink a lot. You still have duties, for example for the page that loads the payment form.

Design choices that keep scope small

1Use a hosted payment page or provider-hosted fields so raw card numbers go straight to the provider.
2Store only provider tokens, never card numbers, and never log full card data or security codes.
3Separate any system that does touch card data from the rest of the network.
4Control and monitor the scripts on your payment pages, since attackers target them to skim cards.
5Keep a list of every vendor in the payment flow and their PCI status.

What changed with PCI DSS v4.x

PCI DSS v4.0 added 64 new requirements, and 51 of them were future-dated until 31 March 2025. They now apply. Two of them, requirements 6.4.3 and 11.6.1, target e-skimming: scripts on payment pages must be authorised, checked for integrity and monitored for tampering. The PCI SSC has since removed them from SAQ A, the shortest questionnaire for merchants that fully outsource card entry, so which ones apply to you depends on your integration.

Tools

Check it for your case.

Sources

Read the official text.

PCI Security Standards Council, PCI DSSchecked 2026-10-25
PCI SSC blog: adopting the future-dated requirements of PCI DSS v4.xchecked 2026-10-25
PCI SSC blog: guidance for PCI DSS e-commerce requirements effective after 31 March 2025checked 2026-10-25
PCI SSC document library (PCI DSS and SAQs)checked 2026-10-25

Frequently asked

Common follow-up questions.

We use Stripe or a similar provider. Are we exempt?

No, but your scope is much smaller. You still confirm compliance, usually with a short SAQ, and keep your payment page and integration secure.

Is PCI DSS a law?

It is an industry standard enforced through contracts with card brands, acquirers and payment providers, not a government law. Some laws refer to it.

Can we store card numbers to make repeat payments easy?

Use the provider's tokens or saved payment methods instead. Storing card numbers yourself brings your systems fully into scope.

Keep reading

Planning a build? Talk it through.

OceanLab designs and builds production software. Tell us what you are planning and we will reply with how we would approach it.