Contents
Does PCI DSS apply to merchants?
The PCI DSS applies to all entities that store, process, and/or transmit cardholder data. If you are a merchant who accepts or processes payment cards, you must comply with the PCI DSS.
What information can be stored while maintaining compliance with PCI DSS?
If required for business purposes, the cardholder’s name, PAN, expiration date, and service code may be stored as long as they are protected in accordance with PCI DSS requirements.
Is PCI a billing address?
PCI differs from other data types in that it is exclusively payment-related information. Other sensitive data that might be included, such as a cardholder name and billing address, is considered personal data, unless that data is present alongside a PAN—in which case it would still be considered PCI.
What rules must be practiced by merchants at POS terminals for PCI DSS compliance?
PCI DSS Requirements:
- Install and maintain a firewall configuration to protect cardholder data.
- Do not use vendor-supplied defaults for system passwords and other security parameters.
- Protect stored cardholder data.
- Encrypt transmission of cardholder data across open, public networks.
What happens if you are not PCI DSS compliant?
If your business doesn’t meet the PCI standards for compliance and the security of cardholder data is compromised, you are liable – and could end up paying thousands of dollars in fines. Some of the additional liabilities and fines include: All fraud losses incurred from the use of compromised account numbers.
Is it legal to store credit card information?
PCI-DSS requirements state that cardholder data can only be stored for a “legitimate legal, regulatory, or business reason.” In other words: “If you don’t need it, don’t store it.”
Is PCI DSS a law?
Though the PCI DSS is not the law, it applies to merchants in at least two ways: (1) as part of a contractual relationship between a merchant and card company, and (2) states may write portions of the PCI DSS into state law. The PCI DSS consists of twelve requirements.
Can a merchant use ” not applicable ” in PCI SAQ D?
While merchants and service providers are allowed to use the phrase “not applicable” in the fields within SAQ D, there is still a lot of work to be done to align. If you are a service provider or merchant that stores credit card data, PCI SAQ D will apply to you.
Who is a merchant according to the PCI DSS?
“For the purposes of the PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services.”. (Source: www.pcisecuritystandards.org)
How does a merchant website work with PCI?
Merchant website provides an inline frame (iFrame) to a PCI DSS compliant third-party processor facilitating the payment process. Merchant website contains a URL link redirecting users from merchant website to a PCI DSS compliant third-party processor facilitating the payment process.
Which is an example of a PCI SAQ D environment?
SAQ D for merchants is valid for merchants that do not meet other SAQ criteria. Examples of PCI SAQ D merchant environments include, but are not limited to: Merchants that can meet the requirements of another SAQ type but have additional requirements for PCI DSS related to their environment.