PCI DSS in the Netherlands and Europe: acquirers, choosing a QSA and how GDPR, NIS2 and DORA meet your card security programme

Why organisations in the Netherlands and Europe pursue PCI DSS

The request usually comes from one of three directions: a Dutch web shop or hotel group told by its acquirer that validation is due, a payment or hosting provider asked by European merchant clients for its Attestation of Compliance, or a fintech whose bank partner expects an AOC in its supplier due diligence.

In each case the trigger is a contract. No Dutch regulator supervises PCI DSS. What changes for a European organisation is everything around it: the privacy and resilience laws covering the same systems, the assessor and the language of your evidence. Who decides your level and route is explained in Do you need PCI DSS? Merchant levels, service providers and who decides.

Who validates PCI DSS compliance for a Dutch organisation

PCI DSS follows the validation route, so there is no certificate and no national accreditation body to check. American Express, Discover, JCB International, Mastercard, UnionPay and Visa each run their own compliance programme. Your acquirer confirms which level applies, whether it expects a Report on Compliance or a Self-Assessment Questionnaire, and where the AOC is submitted.

A ROC is completed by a QSA company, an independent firm qualified by the PCI Security Standards Council. The Council's QSA list can be filtered by place of business, region and language, and each QSA company is authorised only for the regions or countries it has qualified for. Check that the firm is listed for the Netherlands or the European region you operate in, and that it is not shown as "In Remediation". Quarterly external scans, where they apply, come from an Approved Scanning Vendor on the Council's separate list.

Sterling does not validate compliance; the QSA assesses and attests. What to ask a firm before you sign is covered in Choosing a QSA: what to ask before you sign.

European law that meets your PCI DSS programme

GDPR. The cardholder environment rarely holds card numbers alone; names, addresses and order histories sit beside them, and the GDPR governs those. Article 32 asks for security appropriate to the risk, and Articles 33 and 34 require a breach to be notified to the supervisory authority without undue delay and, where feasible, within 72 hours. Run your PCI DSS incident response plan and GDPR breach procedure as one process with two notification paths: card brands and acquirer, and the authority and affected people. See GDPR compliance in the Netherlands and Europe.

The Cyberbeveiligingswet and NIS2. The Dutch law transposing Directive (EU) 2022/2555 took effect on 15 August 2026, with a duty of care, registration and reporting of significant incidents. An in-scope entity's card environment sits inside wider, nationally supervised measures; a supplier to one should expect supply chain clauses, where an AOC is useful evidence but not proof of compliance. See NIS2 in the Netherlands and Benelux.

DORA. Regulation (EU) 2022/2554 has applied since 17 January 2025 to twenty types of financial entity, among them payment and e-money institutions, and reaches the ICT providers serving them. For a payment business, PCI DSS controls feed its ICT risk management framework; for a processor or hosting provider, the AOC becomes one document in the client's due-diligence file and register of information, not a substitute for DORA contract terms. See DORA compliance in the Netherlands and Europe.

Practical logistics. Agree with the QSA company the language of the records it will sample, since Dutch-language evidence may need translation, and list every EU data centre, group entity and service provider from the start: each appears in the AOC.

Local items to settle before the assessment

How Sterling works in the Netherlands and Europe

Sterling supports European clients from its regional headquarters in Enschede, as part of a team working in 60+ countries. Our consultants trace the card data flows, shrink the CDE, close the gaps against all twelve requirements, align incident and supplier processes with GDPR, NIS2 and DORA, and test readiness before the QSA arrives, with evidence held in Effivity. You choose Design™ or Drive™ according to how much of the work your team carries.

FAQs