PCI DSS in Australia: acquirers, QSAs, APRA CPS 234 and data breach rules

Why Australian organisations pursue PCI DSS

For most Australian businesses the first request comes from the acquiring bank that settles their card payments. The bank sets out, usually in the merchant agreement and its onboarding checks, which validation it expects and when it wants the documents back. Retailers, hospitality groups and online stores often meet it when they add a channel such as a mobile app or a phone payment line.

Service providers meet it through their customers. A contact centre taking payments for an Australian telco, a hosting company running a payment platform or a software business whose product touches card data will find an Attestation of Compliance requested in the vendor questionnaire.

Financial services add a regulatory layer. APRA's CPS 234 applies to authorised deposit-taking institutions, general and life insurers, private health insurers and RSE licensees. It asks them to assess the security capability of third parties that manage their information assets. Providers to Australian banks and insurers should expect PCI DSS evidence and CPS 234 questions in one due diligence pack.

The local landscape: acquirers, card brands and QSAs

The PCI Security Standards Council writes the standard but does not enforce it. Enforcement sits with the card brands and acquirers, so your acquiring bank decides your level and validation route, applying the brand rules to your annual transaction volume. The decision guide explains how levels are set.

Unlike ISO certification, there is no national accreditation body in this route. JASANZ accredits management system certification bodies; it has no role in PCI DSS. QSA companies and Approved Scanning Vendors are qualified or approved by the PCI SSC itself, and each has a public list.

When you shortlist assessors, confirm the company appears on the PCI SSC's QSA list, then ask who will perform the fieldwork, whether they can attend your Australian sites, and how sampling will work across states. The guide to choosing a QSA covers the full set of questions.

Local practice that changes the project

One incident plan for the card brands and the OAIC

The Notifiable Data Breaches scheme, created by the Privacy Amendment (Notifiable Data Breaches) Act 2017, applies to organisations and agencies covered by the Privacy Act 1988. Where a breach is likely to result in serious harm, affected individuals and the Office of the Australian Information Commissioner must be notified. Card numbers usually travel with names and contact details, so write one incident response plan whose first hours cover containment, the notifications your acquirer and card brands require, and the NDB assessment.

APRA-regulated clients and their providers

CPS 234 expects incident notification to APRA no later than 72 hours after becoming aware of a material information security incident, systematic testing of controls by functionally independent specialists, and internal audit of controls, including those run by third parties. CPS 230 Operational Risk Management, in force from 1 July 2026, adds substantial provisions on material service providers. For a bank's payment provider, one control set and evidence library can answer both the QSA and the bank's reviewers.

Multi-state and trans-Tasman operations

A group with stores or contact centres in several states, or across Australia and New Zealand, needs one agreed map of card data flows and sites first. Decide early which sites are in scope, which tokenisation or a hosted payment page can remove, and which need an on-site visit.

Local items to check, and where

How Sterling works in Australia

Sterling supports Australian clients from its Sydney office, with consultants working on site in Sydney and remotely with teams in other states. The team draws on 8,100+ client engagements in 60+ countries since 2003. Sterling does not validate compliance: a QSA company assesses and attests, or your acquirer accepts your self-assessment, and we help you prepare for whichever applies.

PCI DSS in Australia: questions buyers ask