Is PCI DSS an EU law?

No. It is an industry standard. Card brands and the banks handling your card payments enforce it and decide which checks you need.

Does PCI DSS still apply if a provider handles our payments?

Yes. A provider can take on much of the work, but you may still be responsible for settings, access or systems affecting payment security.

Does PCI DSS apply if we never store card numbers?

It can. The standard also covers businesses that process or send card data, and systems that can affect its security.

Can Guardera sign our PCI DSS assessment?

No. We help you prepare and put the safeguards in place. If your payment partners require an approved independent assessor, that assessor must complete the assessment.

Is there a PCI DSS certificate?

No. The council that publishes PCI DSS issues no certificates. The card brands and the bank that processes your card payments decide how you show compliance. Businesses with fewer card payments usually fill in a self-assessment questionnaire; those with the most need a report from an approved assessor.

Card industry standard

PCI DSS starts with where your card data goes

PCI DSS, the Payment Card Industry Data Security Standard, sets the security rules for organisations that store, process or send card payment data. Any merchant that accepts card payments, in store, online or in an app, can fall under it.

Discuss PCI DSS preparation See our PCI DSS Compliance service

Type: Payment card security standard
Protects: Payment account data
Covers: Card data storage, processing and transmission
Enforced by: Card brands and banks that process payments
Current version: 4.0.1, in full force since 31 March 2025
Structure: 12 requirements in 6 goals

Who it applies to

Businesses involved in card payments

Merchants accepting card payments through websites, apps or other payment channels.
Payment processors and service providers handling card account data.
Providers and connected systems that can affect the security of card data.

Outsourcing payments can reduce the work, but some responsibilities usually stay with you.

What it asks of you

Protect card data wherever it goes

Trace data and connected systems
Identify where card details enter, move and stay, including services provided by others.
Limit access and connections
Restrict who can reach card data and separate relevant systems where appropriate.
Protect and watch payment systems
Use secure settings, protect stored and transmitted data, and keep logs of system activity.
Find and fix security weaknesses
Carry out the required vulnerability scans and penetration tests, including segmentation testing where applicable. Record the findings, remediation and verification results.
Prepare the required assessment
Ask your payment partners which assessment you need, then collect the policies, logs and test results it requires.

How we help

Find which systems PCI DSS applies to

We map payment data, identify systems that need safeguards and help put those safeguards in place. We organise testing, policies and logs for the assessment you need.

PCI DSS ComplianceMap card data, close the gaps and prepare for the PCI DSS assessment your payment partners require. Cybersecurity Audit & Risk AssessmentAn independent assessment of security and compliance, with risk-based findings and practical recommendations. Penetration TestingFind exploitable security weaknesses and give your team a clear plan for fixing them. Vulnerability ManagementOngoing vulnerability identification, expert risk prioritisation and remediation advice, with progress tracking and verification.

Common questions

Related regulations and standards

DORA
The EU law on IT risk, recovery and suppliers for payment, e-money and other financial firms. A payment firm that handles card data may face both, and access reviews and supplier checks can serve each.

Free 30-minute call

Identify payment systems that need safeguards

Talk through your payment channels and the assessment your partners require in a free 30-minute call.

Discuss PCI DSS preparation hello@guardera.tech