Taking card payments is part of everyday business in Australia - whether you’re running a café, an online store or a professional services firm.
If you accept, store, process or transmit cardholder data in any way, you’ll come across the Payment Card Industry Data Security Standard (PCI DSS). It’s a global security standard designed by the major card schemes to reduce fraud and protect cardholder information.
PCI DSS isn’t just an “IT problem”. It sits across your contracts, your website, your staff training and your policies. And while it’s not an Australian law, it’s usually a condition of doing business with your bank or payment provider. Getting it wrong can be costly.
In this guide, we’ll break down what PCI DSS means for Australian companies, how it intersects with local laws, and the practical steps - legal and operational - you can take to stay compliant and protect your business.
What Is PCI DSS And Who Does It Apply To In Australia?
PCI DSS (currently version 4.0) is a set of security requirements developed by Visa, Mastercard, American Express, Discover and JCB. The goal is simple: reduce the risk of card data compromise.
PCI DSS applies to any business - large or small - that accepts, processes, stores or transmits payment card data. This includes in-store point-of-sale, e‑commerce checkouts, phone orders and recurring billing.
If you use an outsourced, PCI DSS-certified payment gateway (for example, a hosted checkout) you may reduce your compliance scope. But you don’t eliminate it. You’re still responsible for the parts of the payment flow you control - such as how your website collects payment details, how staff handle phone orders, and how your systems are secured.
Key Principles Of PCI DSS
- Build and maintain secure networks and systems (e.g. firewalls, secure configurations).
- Protect cardholder data (encrypt transmission and storage where permitted).
- Maintain a vulnerability management program (patching, anti‑malware, secure development).
- Implement strong access control measures (unique IDs, least‑privilege access).
- Regularly monitor and test networks (logging, scanning, penetration testing where applicable).
- Maintain an information security policy and train your team.
Important: PCI DSS prohibits storing sensitive authentication data - including CVV/CVC and PIN data - at any time. You should also avoid retaining primary account numbers (PANs) unless there’s a legitimate business need and you can store them in a compliant way. If you’re wondering about keeping card details on file, review your obligations around storing credit card details in Australia.
Is PCI DSS Compliance Legally Required In Australia?
PCI DSS is not set out in Australian legislation. However, it is commonly required by contract with your acquiring bank or payment processor. If you want to accept card payments, you’ll be bound by merchant terms that reference PCI DSS requirements and validation activities (for example, self‑assessment questionnaires and vulnerability scans).
If a breach occurs and you weren’t compliant, consequences can include:
- Fines and assessments levied by card schemes via your acquiring bank.
- Forensic investigation and remediation costs.
- Suspension or termination of your merchant facility (losing the ability to accept cards).
- Reputational damage and loss of customer trust.
On top of the contractual fallout, Australian laws may also come into play if personal information is exposed. For example, the Notifiable Data Breaches scheme can require notifying affected individuals and regulators where there’s likely serious harm.
In short: PCI DSS is a contractual must‑have for card acceptance, and it sits alongside your broader Australian legal obligations.
How Do You Become And Stay PCI DSS Compliant?
Your path to compliance depends on how you take payments and your transaction volumes. Many small businesses can complete a Self‑Assessment Questionnaire (SAQ) and, where required, quarterly scans by an Approved Scanning Vendor (ASV). Larger or more complex environments may need validation by a Qualified Security Assessor (QSA).
Step 1: Map Your Card Data Flow
Document where card data is collected, processed, transmitted and stored - from your website or POS, through to any third parties. This “data flow diagram” helps set your PCI DSS scope and reveals ways to reduce risk (for example, moving to a hosted payment page).
Step 2: Minimise What You Handle
Where possible, outsource card collection to a PCI DSS‑certified payment gateway and avoid storing card data yourself. Never store CVV/CVC. If you take card data over the phone, consider tokenisation or secure entry methods so staff don’t see or record card numbers.
Step 3: Secure People, Process And Technology
- Harden systems that touch payment data (patching, anti‑malware, secure configurations).
- Enforce strong passwords and multifactor authentication for administrative access.
- Segment networks to isolate payment systems from other parts of your environment.
- Encrypt transmissions and restrict access on a need‑to‑know basis.
- Train staff regularly on how to handle cardholder data and spotting red flags.
Step 4: Validate And Document
Complete the applicable SAQ, schedule any required quarterly scans, and keep evidence of your controls. Your bank or payment provider can advise which SAQ type fits your setup (for example, SAQ A for fully hosted e‑commerce).
Step 5: Monitor And Improve
PCI DSS is ongoing. Review logs, test controls, patch systems, refresh training and reassess annually. Build security into day‑to‑day operations so compliance isn’t a once‑a‑year scramble.
A quick note on roles: Sprintlaw focuses on the legal and commercial side of compliance - policies, contracts, privacy obligations and risk allocation with suppliers. We don’t perform technical PCI audits, but we can work alongside your security team or QSA to ensure your contracts and governance documents align with your PCI posture.
How Does PCI DSS Interact With Australian Laws?
PCI DSS sits within a broader legal framework in Australia. Even if you meet the PCI baseline, you still need to consider privacy, consumer protection and contractual obligations that apply to your business.
Privacy Act 1988 (Cth) And The Australian Privacy Principles (APPs)
Many businesses that handle customer information must comply with the Privacy Act and APPs (for example, entities with annual turnover greater than $3 million, and several categories of smaller entities such as health service providers and those handling Tax File Numbers). If the Act applies to you, you’ll need practices, procedures and systems that ensure you handle personal information securely and transparently, supported by a clear Privacy Policy.
If your business falls within the small business exemption, the Privacy Act may not legally require a Privacy Policy. However, payment providers and enterprise customers often contractually require one, and it’s best practice when processing payments and operating online.
Notifiable Data Breaches (NDB) Scheme
If a data breach involving personal information is likely to cause serious harm, the NDB scheme can require notifying affected individuals and the Office of the Australian Information Commissioner. While not legally mandated by the NDB scheme, having a tested Data Breach Response Plan makes it far easier to triage incidents, meet timelines and communicate clearly with customers and partners.
Australian Consumer Law (ACL)
Your advertising and customer-facing statements about security and compliance must be accurate. Claims like “we are secure” or “PCI compliant” must be true and current or you risk breaching misleading and deceptive conduct provisions under the ACL. For context on how representations are assessed, see the overview of section 18 of the ACL.
Contracts With Banks, Gateways And Suppliers
Your merchant agreements and payment gateway terms usually set out specific PCI obligations, allocation of risk if there’s a breach, and audit rights. Supplier contracts (for hosting, development, call centres and managed services) should also reflect PCI requirements where those vendors can access cardholder data or your cardholder data environment.
Security Governance
PCI DSS expects documented policies and procedures. From a legal and governance perspective, it helps to adopt an internal Information Security Policy so roles, responsibilities and minimum controls are clearly set out for your team and contractors.
What Legal Documents Should PCI DSS Companies Have?
Strong contracts and clear policies work hand‑in‑hand with your technical controls. The right documents help set expectations, reduce disputes and meet regulatory or contractual requirements.
- Privacy Policy: Explains how you collect, use and secure personal information. If the Privacy Act applies to you, you’ll need a compliant Privacy Policy that reflects your payment flows and data practices.
- Website Terms & Conditions: If you sell online, Website Terms and Conditions set the rules for using your site, managing liability, payments, refunds and acceptable use.
- Merchant And Payment Provider Agreements: Review clauses on PCI responsibilities, audit rights, incident notification and liability caps. Make sure responsibilities align with your actual technical setup (for example, where card data is collected).
- Supplier And Services Agreements: Vendors with access to your systems should be contractually required to follow PCI controls, maintain insurance and notify you promptly about incidents.
- Data Breach Response Plan: A practical playbook that assigns roles, sets escalation criteria and outlines regulatory and customer communications. It’s not mandated by the NDB scheme, but a documented plan materially reduces response time and risk.
- Employment Contracts And Policies: Staff who handle cardholder data need clear obligations on confidentiality, acceptable use and security. Use tailored Employment Agreements and a staff handbook that reinforce PCI‑aligned practices.
- Internal Security Policies: Policies covering access control, password standards, incident response, logging and change management bolster your compliance evidence and day‑to‑day governance.
If you have co‑founders or plan to raise capital, it’s wise to put a Shareholders Agreement in place so decision‑making, ownership and funding are clearly defined - a strong governance base helps when banks or enterprise customers review your security posture.
Practical Tips For Card Data And Contracts
- Keep card data out of your environment where possible by using hosted payment pages and tokenisation.
- In supplier contracts, ensure PCI responsibilities mirror the actual technical design (who collects card data, who stores it, who can access logs).
- Avoid custom payment flows that capture card data on your site unless you have the resources to secure and validate them properly.
- Set clear onboarding and offboarding checklists for staff to maintain access control.
- Maintain a tidy evidence trail - policies, training records, scan reports and SAQs often satisfy your bank’s assurance requests.
Which Business Structure Should You Choose?
Your business structure affects tax, risk and how you enter contracts with banks and suppliers. Most startups consider operating as a sole trader or incorporating a company.
- Sole Trader: Simple and low‑cost to set up. You control everything, but you’re personally liable for business debts and liabilities.
- Company: A separate legal entity that can help limit personal liability and is often preferred when engaging with enterprise customers and financial institutions. It comes with registration and governance requirements.
You’ll also come across trading names and brand choices. If you’re weighing up naming options, this quick guide to business name vs company name explains how they differ and how they’re registered.
There isn’t a one‑size‑fits‑all answer. Think about risk, growth and who you’ll contract with (banks, gateways, larger clients). If you plan to scale or seek investment, a company structure is commonly used.
Don’t Forget The Foundations
Beyond structure, make sure your website and payment pages have clear customer terms, and that your marketing claims about security are accurate. Keep your internal training regular and practical. And if you ever change your payment flow (for example, adding subscriptions or phone orders), revisit your PCI DSS scope and update your documentation accordingly.
Key Takeaways
- PCI DSS applies to any Australian business that processes, stores or transmits cardholder data - even if you use an outsourced payment gateway.
- It’s not legislation, but it’s typically a contractual requirement from your bank or payment provider, with serious consequences for non‑compliance.
- Never store CVV/CVC or PIN data. Minimise what card data you touch, and use PCI‑certified providers wherever possible.
- PCI DSS operates alongside Australian laws, including the Privacy Act (if it applies to you), the Notifiable Data Breaches scheme and the Australian Consumer Law.
- Support your technical controls with the right documents - a Privacy Policy (where required), Website Terms and Conditions, supplier agreements with PCI clauses, and a practical Data Breach Response Plan.
- Choose a structure that fits your risk and growth plans, and consider governance documents such as a Shareholders Agreement if you have co‑founders or investors.
- Sprintlaw can help with the legal and commercial side of compliance - privacy, contracts and policies - while you work with your technical team or QSA on the security implementation.
If you’d like a consultation on PCI DSS compliance or the legal documents your Australian business needs, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no‑obligations chat.
