Glossary
PCI DSS: meaning and examples
PCI DSS is the security standard for any business that stores, processes or transmits card data. Learn what it requires and how to stay compliant.
Updated · By PayToMe Editorial
PCI DSS, the Payment Card Industry Data Security Standard, is a set of security rules for any organization that stores, processes or transmits payment card data. It is maintained by the PCI Security Standards Council and is meant to protect cardholder data from theft and fraud.
How it works
The standard is organized into twelve main requirements, grouped under six goals. They cover building and maintaining a secure network, protecting stored cardholder data, keeping systems patched, restricting access on a need-to-know basis, monitoring and testing networks, and maintaining a security policy. The council updates the standard over time, so check the current version on its website.
What you must do depends on how you take cards:
- Hosted payment page or redirect. The customer enters card details on your provider’s page. Card numbers never touch your systems, so your validation is usually a short self-assessment questionnaire.
- Embedded form on your site. More of your site is in scope, so the questionnaire is longer.
- Storing or keying in card numbers yourself. The heaviest scope, with stricter controls, scans and sometimes an external assessment.
Your payment processor or payment gateway will usually tell you which questionnaire applies and may ask you to confirm compliance every year. Ignoring it can lead to fees or, in the worst case, loss of the ability to accept cards.
Example
A consultant sends invoices with a pay link and a contractor takes cards by phone. Compare their exposure.
| Setup | Who handles card numbers | Typical burden |
|---|---|---|
| Pay link on a hosted page | The provider | Low: short annual self-assessment |
| Typing cards into a spreadsheet | The business | High: avoid entirely |
| Card terminal from a provider | Provider’s terminal | Low to moderate |
The simplest rule: never write card numbers in emails, notes, chat or spreadsheets. If a client sends one, delete it and ask them to use the pay link. You can build the invoice that carries the pay link with the invoice generator, and the guide on accepting credit card payments shows safe setups.
Related terms
- Payment gateway: collects card data securely so you do not have to.
- Payment processor: often your first contact for PCI questions.
- Merchant account: usually carries the PCI compliance requirement in its terms.
PayToMe is in public beta, and online payments are live through Stripe, the payment processor. You can sign in to PayToMe.