Who must comply with the PCI DSS?
Any entity being it a merchant or service provider that stores, processes, and/or transmits cardholder data must be PCI DSS compliant – regardless the size of the entity and volume of transactions made. However PCI DSS requirements do not only apply to electronic data. Businesses are duty bound to dispose of printed material which contains payment card details and credit cardholder data in an appropriate way. In large environments where waste management is outsourced to subcontractors such as paper-shred companies, the entities that request such services must make sure that their ‘service providers’ are PCI DSS complaint as well.
