If your business accepts card payments, protecting your customers’ payment information needs to be a priority. PCI DSS compliance provides a security framework for businesses that handle payment-card data and helps reduce the risk of data breaches and payment fraud.
For a business in South Africa, you also need to consider local data-protection obligations. Understanding PCI DSS, how the requirements apply to your business and what happens when you use a compliant payment provider such as Payfast by Network can make compliance easier to manage.
What is PCI DSS compliance?
PCI DSS stands for “Payment Card Industry Data Security Standard”. It is a set of security requirements designed to protect payment-card data and help businesses keep cardholder information secure.
PCI DSS applies to organisations involved in payment-card processing, including businesses that accept, store, process or transmit card information. The standard covers areas such as network security, access controls, protecting stored cardholder data, monitoring systems and maintaining information security policies.
PCI DSS compliance is not simply about having a secure payment page. It involves the security controls, systems and processes used to protect cardholder data throughout the entire payment process.
Why is PCI DSS compliance important in South Africa?
Businesses accepting card payments in South Africa need to take payment security seriously because cardholder data is sensitive information. PCI DSS provides a recognised framework for protecting this information and reducing the risk of unauthorised access, fraud and data breaches.
For a South African business, compliance can also form part of a wider approach to data protection and payment security. Choosing a PCI DSS-compliant payment service provider can reduce the amount of card information your business needs to handle directly.
Does PCI DSS apply to your business?
PCI DSS applies to any business that accepts or processes payment card transactions.
This includes businesses that:
- Accept credit card or debit card payments online.
- Accept card payments in store.
- Store cardholder data.
- Process card transactions through their own systems.
- Transmit card information to a payment processor.
- Use third-party payment service providers.
The specific compliance requirements for your business depend on how your payment environment is set up and how cardholder data moves through your systems. Outsourcing payment processing can reduce your compliance scope, but it does not automatically remove every PCI DSS responsibility.
What are the PCI DSS compliance levels?
PCI DSS validation is not one size fits all. The validation requirements that apply to a merchant can depend on factors such as transaction volumes, payment channels, card brands and the merchant’s payment environment. Businesses should confirm their specific validation requirements with their acquiring bank or relevant payment brands.
Depending on the environment, a business may be able to validate compliance through a self-assessment questionnaire (SAQ). More complex or higher-risk environments may require a formal assessment by a Qualified Security Assessor (QSA) and documentation such as a compliance report.
This means a small ecommerce business making a handful of sales a day and a large organisation processing substantial volumes of card transactions may have different validation requirements. Transaction volume is therefore useful when considering compliance levels, but it is not the only factor that determines what a business needs to do.
How can your business comply with PCI DSS?
The steps your business needs to take depend on how you accept and process card payments. If your business handles cardholder data directly, you may need to implement controls across your technology environment and internal processes.
This can include:
- Monitoring firewalls and network security controls.
- Protecting systems against malware and other threats.
- Restricting access to cardholder data.
- Using strong authentication and access controls.
- Encrypting card information in transit.
- Protecting stored cardholder data.
- Monitoring and logging access to systems.
- Regularly testing security controls.
- Maintaining information security policies.
- Completing the appropriate compliance assessment and documentation.
For businesses without the technical resources to manage these requirements internally, using a PCI DSS-compliant payment provider can simplify the payment environment.
How does PCI DSS relate to POPIA in South Africa?
PCI DSS and POPIA (the Protection of Personal Information Act) have different purposes, but both are relevant when a business handles customer information. POPIA governs the processing and protection of personal information in South Africa. PCI DSS focuses specifically on protecting payment-card data and the systems involved in card transactions.
Meeting PCI DSS requirements can support your approach to protecting cardholder information, but PCI DSS compliance does not automatically mean that your business meets every POPIA obligation. Businesses should therefore consider both frameworks when collecting, processing and protecting customer and payment information.
What happens if a business is not PCI DSS compliant?
Non-compliance can increase the risk associated with handling payment-card data and may expose a business to consequences under the applicable contractual requirements of the card brand or acquiring bank. It can also increase the risk of security incidents and data breaches if appropriate security controls are not in place.
The exact consequences of non-compliance depend on the business, its payment environment and the applicable compliance programme. Rather than treating compliance as a once-off exercise, businesses should maintain their security controls and review them regularly.
How does Payfast simplify PCI DSS compliance?
Payfast is a PCI DSS Level 1 Service Provider. When a customer pays through the Payfast redirect flow, they are taken to a secure Payfast payment page to enter their card information. Payfast handles the payment information within its payment environment rather than having customers enter it directly on the merchant’s website.
This can reduce the merchant’s exposure to cardholder data and simplify the payment environment they need to manage. However, merchants should still understand their own PCI DSS responsibilities and confirm their specific compliance obligations.
Payfast’s current PCI DSS certification covers its Payfast aggregation and gateway services as a Level 1 Service Provider under PCI DSS v4.0.1.
Make PCI DSS compliance easier to manage
PCI DSS compliance is about more than ticking a box. It requires businesses to understand how cardholder data moves through their systems and to put appropriate security controls in place. For many businesses, using a PCI DSS-compliant payment provider can reduce the complexity of handling card information directly.
Payfast is a PCI DSS Level 1 Service Provider with a redirect payment flow that allows customers to enter their card details securely within the Payfast payment environment. For businesses looking for a payment solution that can help reduce the complexity of handling cardholder data, Payfast provides a way to accept online card payments without building the entire payment-security environment yourself.
