Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

PCI DSS isn't a law. Why can I be prosecuted for not being compliant?

share|improve this question
Under what jurisdiction and circumstances? – Polynomial Sep 11 '12 at 9:32
up vote 18 down vote accepted

First, IANAL. Secondly, this is entirely dependant on your local laws and regulations.

PCI-DSS is a guideline, but adherence to the guideline may be a requirement as part of certain laws. I'm not aware of any countries that do this, but in such a case you could be prosecuted if you violate a law that makes PCI-DSS adherence mandatory.

The more common case is not prosecution, but rather a civil suit. PCI-DSS is commonly a requirement as part of a contract between a merchant and a payment provider or bank, as part of their payment processing services contract. Violation of PCI-DSS results in a breach of contract, which allows them to sue you. Penalties and other terms are usually stated in such contracts.

share|improve this answer
More specifically, compliance with PCI-DSS is part of the contractual agreement between merchants and members of the PCI industry group, of which not all credit card issuers are members of. – Scott Pack Sep 11 '12 at 12:08
+1 for your second paragraph. – Kyle Rozendo Sep 11 '12 at 19:58

You can't be charged with not complying with PCI DSS, it's not a law. You can be charged with crimes like negligence if it is determined that you willfully ignored your duty of care, and not following PCI rules could be one instance of that. It's unlikely that would happen though, more likely you or your company would get sued for monetary damages, and not following PCI would be one of the pieces of evidence used to show culpability.

share|improve this answer
AFAIK "negligence" isn't a crime except in limited situations involving death or injury to persons. For legal advice consult a licensed attorney. – user35648 Dec 30 '13 at 6:11

Compliance with PCI DSS is required by law in Nevada (Nev. Rev. Stat. Ch. 603A) and Washington (Wash. H.B. 1149 (2010).

share|improve this answer
NRS 603A.900 provides only civil remedies for a breach, yet NRS 603A.910 provides that a court may order a party who is "convicted of unlawfully obtaining or benefiting from personal information" to pay restitution. These sections appear to contradict one another, unless there's another Nevada statute making a breach of Ch. 603A a crime. – user35648 Dec 30 '13 at 5:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.