PCI DSS is the payment card industry's standard for protecting card data. It matters for vending machines too.
PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements for organizations that process, store, or transmit card data. In vending, it mainly applies to reader suppliers and payment providers. Machine operators should use solutions that the supplier states are compliant.
Who it applies to
Anyone who handles card data. Duties depend on the role – they differ for the payment provider and the machine operator.
What it means in practice
- Choosing readers from suppliers that state compliance.
- Not storing card data in the operator's systems.
- Keeping reader software up to date.
Where to find details
The body responsible for the standard publishes the full requirements. General information on payment devices in machines is on the page with vending machines (publisher's site).
FAQ
Does a machine need PCI DSS certification? Requirements depend on the role and data handling. Ask your payment provider.
Is PCI DSS a law? It is an industry standard, not a statute. It applies through payment industry contracts.