Rule 31 of 33

PCI DSS v4.0.1 (card-data security)

What does PCI DSS require if my website takes card payments?

Any business accepting card payments must meet PCI DSS. Version 4.0.1 adds requirements that catch small merchants, notably scripts on payment pages being inventoried and monitored, stronger authentication, and an annual self-assessment questionnaire. Using a hosted payment page reduces scope but does not remove it.

What the rule requires

All “future-dated” v4 controls mandatory since 31 Mar 2025 - the grace period is over.

Who it catches

Any business that stores, processes or transmits card data - including e-commerce sites that merely embed a payment page or script. Penalty is higher fees, fines, or losing the ability to take cards.

What this looks like in practice. Your checkout page loads a third-party script you don't monitor, and an attacker quietly injects a card skimmer. That's exactly how British Airways lost 380,000 customers' cards - and drew a £20M fine.

How to check whether you comply

The checkConfirm your payment-page scripts are inventoried and integrity-monitored (6.4.3 / 11.6.1), MFA covers all access to cardholder data, and you run authenticated internal vulnerability scans. 51 once-optional controls are now required.

Read it yourself

We would rather you checked us than took our word for it. This links to the law as published, not to our summary of it.

Primary source PCI SSC ↗ Real case British Airways: £20M after its checkout page was skimmed ↗

Questions people ask

What does PCI DSS require if my website takes card payments?

Any business accepting card payments must meet PCI DSS. Version 4.0.1 adds requirements that catch small merchants, notably scripts on payment pages being inventoried and monitored, stronger authentication, and an annual self-assessment questionnaire. Using a hosted payment page reduces scope but does not remove it.

Who does PCI DSS v4.0.1 (card-data security) apply to?

Any business that stores, processes or transmits card data - including e-commerce sites that merely embed a payment page or script. Penalty is higher fees, fines, or losing the ability to take cards.

How do I check whether we comply with PCI DSS v4.0.1 (card-data security)?

Confirm your payment-page scripts are inventoried and integrity-monitored (6.4.3 / 11.6.1), MFA covers all access to cardholder data, and you run authenticated internal vulnerability scans. 51 once-optional controls are now required. You can also run our free website check, which tests 25 technical items in about twenty seconds, or book a review if this rule needs a documented answer.

Other rules that catch the same businesses

Rule 32Subscription auto-renewal laws (ROSCA + state ARLs) Rule 33Colorado AI Act (SB 24-205, as amended) Rule 2ADA Title III (US web accessibility) Rule 3Accessible Canada Act (federal) All of themThe full 33-rule table, searchable

Find out which of the 33 apply to you

The fine risk check asks a few questions about your business and tells you which rules catch you, with the deadlines. Nothing you tick leaves your browser.

Check my fine risk

This page summarises a legal obligation in plain language so you can work out whether it applies to you. It is not legal advice, and the primary source linked above governs. Last reviewed 2026-10-03.