PCI DSS is a card-brand–mandated standard, not a government law, but the major brands require compliance in their rules, and acquiring banks enforce it. In practice, if you accept cards, PCI compliance is required to process them.
Host Merchant Services – Credit Card Processing and Point of Sale for Small Business
Get the payment processing solution that fits your business