PCI DSS by region
PCI DSS in the UK: acquirers, QSAs, UK GDPR and Cyber Essentials
What is different about PCI DSS for UK merchants and service providers: who enforces it, how to check a QSA, and how UK GDPR, Cyber Essentials and the NIS Regulations sit beside it.
Key points
- PCI DSS in the UK is contractual, not statutory: it reaches a UK merchant through its acquirer and the card brands, and a UK service provider through its customers' contracts.
- No UK accreditation step applies. QSA companies and approved scanning vendors are qualified by the PCI Security Standards Council itself, so check its public lists.
- Card data that identifies a cardholder is also personal data, so UK GDPR security duties and PCI DSS apply to the same systems at once.
- Cyber Essentials, which PPN 014 expects of many public-sector suppliers, is a separate certificate. A PCI DSS AOC does not replace it, and it does not replace an AOC.
Why UK organisations pursue PCI DSS
For a UK merchant the trigger is usually the acquirer. The merchant agreement signed to accept cards requires compliance, and the acquirer asks each year for the validation documents: an SAQ and its AOC for most merchants, a Report on Compliance for the largest. For a UK service provider the trigger is a customer. A contact centre taking payments by phone or a London software house hosting a retailer's checkout receives a supplier questionnaire asking for a current AOC.
What changes in the UK is the company PCI DSS keeps. The same systems usually fall under UK data protection law too, so one control set has to serve several readers. The route itself is explained in PCI DSS validation step by step: ROC, SAQ and AOC.
Who enforces PCI DSS in the UK: acquirers, card brands and QSAs
The acquirer. The PCI Security Standards Council maintains the standard; the card brands and acquirers enforce it. Your acquirer, typically a financial institution that processes card transactions for you, confirms your merchant level, tells you which validation it expects and receives your documents. Mastercard, for example, requires merchants to submit their validation documents to their acquiring bank.
The card brands. Merchant levels are set by each brand on annual transaction volume. Visa bases the level on a merchant's Visa transactions over twelve months; Mastercard requires a Report on Compliance from Level 1 merchants and an annual SAQ at Levels 2 and 3. Which questionnaire fits is covered in Which SAQ applies to you: eligibility explained.
The assessor. There is no national accreditation step for PCI DSS in the UK. QSA companies are qualified by the PCI Security Standards Council, which advises clients to check its public QSA list to confirm a company has kept its status; scanning vendors appear on a parallel ASV list. A UK business with its own security team can also sponsor employees through the Council's Internal Security Assessor programme, where the acquirer and the card brands accept an ISA-completed assessment. Sterling does not validate compliance; the QSA assesses and attests.
UK laws and practice that change a PCI DSS project
UK GDPR and the Data Protection Act 2018. The UK GDPR applies alongside the Data Protection Act 2018, as amended in stages by the Data (Use and Access) Act 2025. The ICO's security guidance restates the duty to apply appropriate technical and organisational measures for a level of security appropriate to the risk. Where card data identifies a cardholder, the same CDE controls help show that duty is met, but an AOC is not a statement of legal compliance. Align PCI DSS data retention and incident response with your data protection programme.
Cyber Essentials and PPN 014. PPN 014 applies to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. It makes a Cyber Essentials certificate, or an equivalent, essential when data is passed to a supplier, renewed every year of the contract. A contact centre taking payments for a public body may therefore need both.
The NIS Regulations 2018. These apply to operators of essential services and relevant digital service providers. If you or a client are in scope, let the PCI DSS evidence serve that regime too.
Logistics. Every location and third party that touches card data sits in scope, so an offshore contact centre taking payments for a UK brand is assessed with it. Agree site visits with the QSA early and collect every provider's AOC. Shrinking what sits in scope first is covered in PCI DSS scoping and segmentation: shrinking the CDE.
What to check for a PCI DSS project in the UK
| Local item | What it means for your project | Where to verify it |
|---|---|---|
| Your acquirer's expectations | Your merchant level, the validation type (ROC or SAQ) and the deadline for your documents | Your merchant agreement and your acquirer's compliance team |
| Card brand levels | Set by each brand on annual transaction volume; Mastercard, for example, requires a Report on Compliance from Level 1 merchants | The Visa and Mastercard security compliance pages |
| QSA and ASV status | The company assessing or scanning you must be currently listed; Sterling does not validate | The PCI Security Standards Council's public QSA and ASV lists |
| UK GDPR and the Data Protection Act 2018 | Security, retention and breach duties that sit alongside the CDE controls | The Information Commissioner's Office website |
| Cyber Essentials under PPN 014 | A separate certificate for central government and NHS contracts, renewed every year | The PPN 014 page on GOV.UK and the NCSC certificate search |
How Sterling works in the United Kingdom
Sterling supports PCI DSS in London and across the UK from its London office as part of an international practice of 8,100+ client engagements in 60+ countries since 2003. We help UK merchants and service providers run one control set that serves PCI DSS, UK GDPR, Cyber Essentials and ISO/IEC 27001, with the evidence kept in Effivity.
How Sterling supports UK merchants and service providers
An AOC your acquirer accepts, with your UK obligations covered by the same controls
We confirm your level and validation type with your acquirer, trace every card data flow, reduce the scope, close the gaps with your team, run an internal assessment and stay with you through the QSA's fieldwork and every annual cycle after it. We ensure successful validation for our clients.
Book a free discovery callPCI DSS in the UK: questions buyers ask
Is PCI DSS a legal requirement in the UK?
No, PCI DSS itself is not UK law; it binds you through your acquirer agreement, the card brands' programmes or your customers' contracts. UK GDPR security duties apply separately to any card data that identifies a cardholder.
Who decides our PCI DSS merchant level in the UK?
The card brands set levels by annual transaction volume, and your acquirer confirms yours and tells you what to submit. Ask your acquirer before choosing between a ROC and an SAQ.
Does Cyber Essentials cover PCI DSS?
No, they are separate. Cyber Essentials certifies five basic technical controls across your organisation, while PCI DSS validates twelve requirements across the cardholder data environment; public-sector contracts under PPN 014 may need Cyber Essentials as well as your AOC.
How do we find a QSA for a PCI DSS assessment in London?
Start from the PCI Security Standards Council's public QSA list and confirm the company is currently listed. Then ask who will carry out fieldwork at your UK sites and when.
PCI DSS by region
Every guide in the PCI DSS series is written for one question and links back to the hub for the whole picture.
- PCI DSS compliance in Australia
- PCI DSS compliance in India
- PCI DSS compliance in the Netherlands and Europe
- PCI DSS compliance in Singapore and South East Asia
- PCI DSS for SaaS, hosting and managed security providers
- The PCI DSS assessment
- PCI DSS compliance in the Philippines
- PCI DSS compliance in the United Kingdom
- PCI DSS timeline
- PCI DSS training
- PCI DSS compliance in the UAE and GCC
Keep exploring
Explore more about PCI DSS
Watch a video on how to implement PCI DSS here.
Watch a video on PCI DSS requirements here.
PCI DSS resources
Services for PCI DSS
Talk to a consultant
Plan your PCI DSS compliance in the United Kingdom with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice