New Zealand · Compliance
PCI DSS compliance in New Zealand
Achieve PCI DSS compliance in New Zealand with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Sydney office team
- Effivity software included
- Academy training included
Who asks for PCI DSS in New Zealand
Clients include
PCI DSS compliance in New Zealand at a glance
Two New Zealand instruments bear on PCI DSS. Not one of them names it. So why do buyers in New Zealand keep asking for evidence of it?
Card data rules in New Zealand come from the payment industry more than from Parliament. PCI DSS is set by the PCI Security Standards Council and required by the card brands and acquiring banks of merchants and service providers that store, process or transmit cardholder data; validation is by a Qualified Security Assessor's Report on Compliance or a Self-Assessment Questionnaire, according to the acquirer's instructions. The Privacy Act 2020 adds its own duties, with reasonable security safeguards under principle 5 and notification of serious-harm breaches, and the Reserve Bank's outsourcing policy makes large banks answerable for their providers. Sterling does not validate compliance. From its Sydney office, Sterling helps New Zealand merchants and providers reduce scope, close gaps and prepare for their assessor or questionnaire, with Effivity and Sterling Academy included with the engagement.
Who needs PCI DSS in New Zealand, and what happens without it
These are the organisations in New Zealand that most often need to show PCI DSS.
- Merchants that store, process or transmit cardholder dataPCI DSS requirements come from the payment brands and acquirers rather than from a New Zealand statute, so each merchant follows its acquirer's validation instructions.
- Service providers handling card data for othersPrinciple 5 of the Privacy Act and customers' contracts both lead to requests for evidence of security.
- Providers to large banksThe RBNZ outsourcing policy makes banks answerable for outsourced functions, so payment providers face assurance requests.
- Online and SaaS businesses taking paymentsA breach of personal information that is likely to cause serious harm must be notified to the Privacy Commissioner and affected people as soon as practicable.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the PCI DSS readiness checkPCI DSS requirements in New Zealand
Strip away the vocabulary and PCI DSS asks any business that stores, processes or transmits card data to comply in six areas.
In New Zealand these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: PCI DSS explained →
How to achieve PCI DSS compliance in New Zealand
One team from the Sydney office carries the work from scoping to sign-off. Clients across New Zealand are served from Sterling's Sydney office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against PCI DSS and the New Zealand requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does PCI DSS compliance take in New Zealand?
There is no standard duration: it depends on your scope and on how much of the system already runs. In New Zealand these are the factors that set the timeline.
- Cardholder-data environment scope and segmentation
- Number of payment channels, systems and service providers
- Remediation of gaps found in a pre-assessment
- QSA and acquirer scheduling
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does PCI DSS compliance cost in New Zealand?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In New Zealand these factors move both.
- Size of the cardholder-data environment
- Segmentation and tokenisation options
- QSA fees quoted separately from consulting
- Number of service providers to validate
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
PCI DSS consultants and assessors in New Zealand
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers PCI DSS and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in New Zealand are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive PCI DSS in New Zealand (3)
| Instrument | How it treats the standard |
|---|---|
| Privacy Act 2020 — principle 5 and serious-breach notification | Does not name the standard Asks for security safeguards that are reasonable in the circumstances, and notification of a breach that has caused or is likely to cause serious harm. |
| RBNZ Outsourcing policy (BS11) | Does not name PCI DSS Requires large banks to keep control of outsourced functions and cope with a provider's failure. |
| Government Procurement Rules (5th edition) | Does not name the standard Each tender sets its own supplier criteria. |
Accreditation, audit language and remote audits in New Zealand
Compliance validated, not certified: a Qualified Security Assessor (QSA) issues a Report on Compliance, or the entity completes a Self-Assessment Questionnaire, as the payment brands and acquirer require. No QSA is named here unless verified on the PCI Security Standards Council listing. Edition and transition details: PCI DSS hub →
Audit language
Validation documents are normally in English; confirm the language the acquirer and QSA require.
Remote and on-site
Parts of an assessment can be done remotely, but cardholder-data environments, data centres and physical controls in scope are normally verified on-site.
PCI DSS in New Zealand: questions clients ask
Does New Zealand law require PCI DSS compliance?
No New Zealand statute is recorded as requiring it; PCI DSS is imposed by the payment brands and your acquirer. The Privacy Act 2020 separately asks for reasonable security safeguards and notification of serious-harm breaches. Ask your acquiring bank which validation you owe, and take legal advice on your Privacy Act duties.
Who validates PCI DSS compliance for a New Zealand business?
It depends on your merchant or service-provider level. A Qualified Security Assessor issues a Report on Compliance, or the entity completes a Self-Assessment Questionnaire, as the brands and acquirer require. Sterling prepares the business but does not validate it. Your acquirer will tell you which route applies.
Would a bank ask its payment suppliers for PCI DSS under BS11?
BS11 does not name PCI DSS. It requires large banks to keep control of outsourced functions and continue basic services if a provider fails. A bank may ask a card-handling supplier for PCI DSS validation as part of its own risk assessment, so ask the bank what assurance it expects.
How does reducing scope help a New Zealand merchant?
A smaller cardholder-data environment means fewer systems to assess and secure. Segmentation, tokenisation or using a validated payment provider can shrink scope, which affects both timeline and cost drivers. Settle the design with your acquirer and assessor before building controls, since they decide whether the reduction is accepted.
More on PCI DSS for New Zealand organisations
- PCI DSS: the complete guide
- Watch: How to implement PCI DSS
- Banking and financial services: PCI DSS for the sector
- BPO and contact centres: PCI DSS for the sector
- E-commerce and retail: PCI DSS for the sector
- Fintech and payment facilitators: PCI DSS for the sector
- Healthcare providers and insurers: PCI DSS for the sector
- Hospitality and travel: PCI DSS for the sector
- Software and hosting: PCI DSS for the sector
- PCI DSS compliance in New Zealand and every other standard Sterling delivers there
Other standards New Zealand businesses ask Sterling for
Organisations in New Zealand often combine PCI DSS with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Sydney office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Privacy Act 2020 — principle 5 and serious-breach notification — privacy.org.nz (accessed 8 Oct 2026)
- RBNZ Outsourcing policy (BS11) — rbnz.govt.nz (accessed 8 Oct 2026)
- Government Procurement Rules (5th edition) — procurement.govt.nz (accessed 8 Oct 2026)
Talk to a consultant
Plan your certification with the Sydney team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
australia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice