certification
PCI DSS
A security standard for payment card data. Card brands and acquirers decide who has to prove it and how, and no law requires it. It reaches whoever stores, processes or transmits card data.
at a glance
- what it is
- The Payment Card Industry Data Security Standard, published by the PCI Security Standards Council. Its document library features v4.0.1.
- who it covers
- Entities that store, process or transmit cardholder data or sensitive authentication data, or could affect the security of the environment that does. The Council names merchants, processors, acquirers, issuers and service providers.
- who checks
- The payment brands and your acquirer set the validation. You submit a self-assessment questionnaire or an assessor's report, with an attestation of compliance.
- penalties
- None under law and none set by the Council. Consequences come from your contract with your acquirer, which this page did not read.
- legal weight
- A contractual standard. Meeting it does not show compliance with GDPR or any other law.
- status
- The Council retired v4.0 on 31 December 2024. The new requirements it had dated in the future took effect on 31 March 2025.
basis PCI SSC, PCI DSS standard page; PCI SSC FAQ on compliance programmes; PCI SSC blog on v4.0.1; PCI SSC blog on the future-dated requirements; GDPR Art. 32(1)
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my ruleswho sets the rules you are tested against
- 1the council writes the standardit publishes the requirements and the forms
- 2the payment brands run compliance programmesthey decide who must validate, how and when
- 3your acquirer asks youthe bank that handles your card payments says what to submit
- 4you validate and attesta questionnaire or an assessor's report, with a signed attestation
basis PCI SSC FAQ 1436; PCI SSC, SAQ D for Merchants v4.0 (completion steps)
the dates the council states for the current version
- 111 June 2024: v4.0.1 announced, a limited revision with no requirements added or removed
- 231 December 2024: v4.0 retired, v4.0.1 is the supported version
- 331 March 2025: 51 of the 64 new requirements, dated in the future until now, take effect
- 42 November 2026: the council's document library features v4.0.1
basis PCI SSC blog, Just Published: PCI DSS v4.0.1, 11 June 2024; PCI SSC blog on the future-dated requirements, 20 August 2024; PCI SSC document library as read on 2 November 2026
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- find out what you must prove, and for which card data
Learn what your acquirer requires, find every place card data goes and take out of scope what you can.
- choose the route and get the current documents
Fix which form or report you will complete and put the current standard in the hands of the people doing the work.
- build the controls, requirement by requirement
Close the gaps in the twelve requirements for everything that stayed in scope.
- complete the form and attest
Fill in the form from evidence, have an officer sign and send it to the party that asked.
- keep it true each year
Run the controls through the year and repeat the validation when it is due or when the payment flow changes.
what a certificate does and does not show
Read this before a customer asks you for one.
anyone who stores, processes or transmits card data, or can affect the security of the place that does
a self-assessment or an assessor's report, with an attestation of compliance, set by your acquirer and the card brands
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
the long read
The full explanation, section by section, with the sources.