I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service?

As an example, if I were to to sign up to a service that lets me generate a document and I send that document to another person through the services web dashboard.

1 Answer 1


If you're asking whether a generic email provider such as gmail has PCI compliance issues because of what it's users may do, then no. Consider the DSSv3 definition:

PCI DSS applies to all entities involved in payment card processing—including merchants, processors, financial institutions, and service providers, as well as all other entities that store, process, or transmit cardholder data and/or sensitive authentication data.

While the situation you're talking about involves a case where the service provider is used to "transmit cardholder data", a generic email provider is not an "entit(y) involved in payment card processing" (at least not insofar as it's customers use it to send email; it may be insofar as it might charge those customers, but that's a separate issue).

The individual sending the mail has PCI obligations because it's their data, the carrier does not because it isn't.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .