FAQ #1092 Diff

Yes. PCI DSS applies tois intended for any entity that stores, processesprocesses, or transmits cardholder data.data — regardless of whether these activities are conducted directly or by a third-party service provider.

IfWhen a merchant outsources all theirits payment operations, the applicableprocessing to a third party and does not store, process, or transmit cardholder data, many PCI DSS requirements for the protection ofmay not apply directly to the merchant’s environment. However, this does not remove the merchant’s responsibility to ensure account data would apply to the environment(s) where the data is actually stored, processed and transmitted, such asproperly protected by the third party service providers, payment gateways, etc. However, it is the responsibility of the merchant to ensure that the data they share with third parties is properly handled and protected ? just because a merchant outsources all payment processing does not mean that the merchant won?t be held responsible by their acquirer or payment brand in the event of an account data compromise.

Additionally, the merchant?s acquirer or payment brand may still require the merchant to validate their PCI DSS compliance status. For example, the merchant may be required to complete SAQ A in which the merchant attests that they have outsourced all payment processing services, do not store account data, and that they are compliant with PCI DSS Requirement 12.8. PCI DSS Requirement 12.8 states that merchants must have written agreements with their service providers that include the service provider?s acknowledgement of their responsibility for securing the data in their possession, and also requires that merchants monitor their service provider?s compliance at least annually.party.

Merchants remain responsible for:

Ensuring the provider is PCI DSS compliant for the services offered,
Maintaining written agreements with the provider that include acknowledgment of their responsibilities (Requirement 12.8.2),
Monitoring the provider’s compliance status at least annually (Requirement 12.8.4),
Clearly defining and understanding any shared responsibilities.

Merchants are still required to validate PCI DSS compliance, typically through a Self-Assessment Questionnaire (such as SAQ A). Merchants should checkconfirm their compliance obligations with the organization(s) that manage their compliance program—such as their acquirer or payment brand to determine their compliance obligations when all payment processing is outsourced.brand—also referred to as compliance-accepting entities.