If you accept credit cards as payment, you must comply with PCI DSS. How you accept credit cards determines at what level. For instance, if you have a swipe terminal that connects to a POTS line and none of it touches your network, you are still required to abide by PCI and do a Self Assessment Questionnaire. Each SAQ begins with a section that reads "Before you Begin" that walks you through which one fits.
PS If you fully outsource the processing of credit card data to a 3rd party, you still must complete an SAQ-A report.