PCI DSS in plain words

PCI DSS (Payment Card Industry Data Security Standard) is the international payment card security standard: a set of technical and organizational requirements for anyone who stores, processes or transmits card data. It was developed by the PCI SSC council, and it applies to merchants, payment processors, acquiring banks and issuers.

In plain words

If your store accepts cards, the card data (number, expiry date, CVV) must travel only by a secure route. PCI DSS describes exactly how. The PCI SSC council explains that the standard is a baseline of requirements for protecting payment account data, and it applies to everyone who stores, processes or transmits cardholder data, or who can affect the security of the environment where it resides (PCI SSC).

Important: PCI SSC itself doesn't penalize anyone or decide who must validate compliance. That is determined by the payment brands and the acquirer, the bank that accepts your payments. So the first step is to ask your bank or payment provider what exactly they require (PCI SSC, for merchants).

How to minimize the scope of requirements

The less card data passes through your site, the fewer the requirements. E-commerce is a card-not-present environment, and payment data in it must be protected under PCI DSS (PCI SSC).

For self-assessment there are SAQ questionnaires, different ones for different environments, each with eligibility criteria (same source). The simplest, SAQ A, is meant for merchants whose card data operations are fully outsourced to providers that are themselves PCI DSS compliant, and who do not store, process or transmit card data in their own systems (PCI SSC, blog).

In practice: a payment page fully displayed by the payment provider (a redirect or its form) is usually seen as the lightest option. Your own forms that collect the card number greatly increase the scope. Encryption by itself does not take an environment out of the standard if the encrypted data and the keys are accessible in the same place (PCI SSC).

What changed recently

In 2025, changes were made to SAQ A: requirements 6.4.3 and 11.6.1 (script control on the payment page) and 12.3.1 were removed from the questionnaire, and an eligibility criterion was added: the merchant confirms that its site is not susceptible to attacks from scripts that could affect its e-commerce. The changes took effect on March 31, 2025, and they don't cancel the standard's requirements themselves, but change the way of validating them (PCI SSC, blog). The takeaway for a store: third-party scripts on the payment page (chat, analytics, widgets) should be limited to what's needed.

How this applies depends on your acquirer, so agree on the form of validation with them. Separately, search results suggest that vendors interpret differently which scenarios (iframe or redirect) this criterion applies to, so rely on the official PCI SSC FAQs and your bank.

Common mistakes

• Storing the CVV or the full card number in a database, a mailbox or a CRM.
• Accepting card details in chat, a messenger or by phone without a secure solution.
• Not asking the bank which level of validation is required.
• Adding third-party scripts to the payment page without need.
• Treating compliance as a one-off. It is an ongoing process.

FAQ

Is PCI DSS mandatory for an online store in Ukraine? The standard applies to everyone who handles card data, but whether to require validation and in what form is decided by the payment brands and the acquirer. Ask your bank or payment provider (PCI SSC).

Do I need PCI DSS if payment goes through the provider's payment page? The scope of requirements for you is much smaller, but it doesn't fully release you from responsibility: validation depends on your setup and your bank.

What is an SAQ? A self-assessment questionnaire for merchants who can validate compliance on their own. Different setups have different questionnaires.

Which version of the standard is current? PCI DSS v4.0.1 is published in the PCI SSC document library (PCI SSC, document library).

Related terms

• Payment methods for an online store in Ukraine
• Payment fraud and 3-D Secure
• Online store security: the minimum
• Checkout

Sources

• PCI SSC, PCI DSS — pcisecuritystandards.org/standards/pci-dss
• PCI SSC, Merchants — pcisecuritystandards.org/merchants
• PCI SSC, Document Library — pcisecuritystandards.org/document_library
• PCI SSC blog, Important updates announced for merchants validating to SAQ A — blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a