Loyalty Register glossary
PCI DSS
The Payment Card Industry Data Security Standard: security requirements for any organization that stores, processes or transmits card data.
PCI DSS stands for the Payment Card Industry Data Security Standard, the set of security rules for organizations that handle payment card data. The PCI Security Standards Council describes it as a baseline of technical and operational requirements designed to protect payment account data. It applies to every entity that stores, processes or transmits cardholder data, including merchants and service providers. For a loyalty team, the practical meaning is simple: the moment a program feature touches card numbers, the systems behind it come under the standard.
Updated · By Loyalty Register Editorial TeamRelated terms
Is PCI DSS a law or a certification?
Neither, strictly. The Council writes the standard, but whether a company must comply, and how it proves it, is decided by the organizations that run compliance programs, such as the payment card brands and the acquiring banks. The obligation usually arrives through the merchant’s contract with its acquirer. Larger organizations may be assessed by a Qualified Security Assessor, an independent company qualified by the Council to validate compliance; smaller ones often complete a self-assessment. People say “PCI certified”, but what exists is validated compliance for a given period.
Does PCI DSS apply to a loyalty program?
A points balance is not card data, so a program that only stores names, emails and points can sit outside the standard. Scope arrives through features that touch cards:
- members link a payment card to earn points automatically (card-linked earning);
- members pay with a card for part of a reward, or buy points;
- the loyalty platform receives transaction files that contain full card numbers;
- a co-brand card program shares account data with the loyalty system;
- members identify themselves at checkout with the card they paid with.
Each of these can bring the loyalty platform, its databases and the people who access them into the cardholder data environment the standard governs. Being in scope means controls, audits and ongoing cost, and a breach that exposes card numbers linked to member accounts is both a payments incident and a loyalty incident.
How do programs keep PCI scope small?
Keep raw card numbers out of loyalty systems entirely. Tokenization replaces the card number with a token that is useless outside the payment environment, so the loyalty platform can match a purchase to a member without holding card data. Hosted payment pages and the payment provider’s own checkout handle points-plus-cash and points purchases. Transaction feeds are masked before they reach the loyalty database, and retention rules delete anything card-related that is no longer needed.
What should you check with vendors?
Ask every vendor that touches transactions whether it is in scope, which compliance evidence it can share, and how responsibility is split between you and them; put the questions in your RFP. Map each loyalty process that might see a card number, from enrollment to customer service screens, and confirm where card data stops. Recheck that map whenever you add a payment feature, because a new card-linked offer or a points purchase flow can quietly pull the program into scope.