PCI compliance and PCI DSS mean respectively Payment Card Industry compliance and Payment Card Industry Data Security Standard. All websites no matter how large or small, if they take payments from customers online via credit card, must be compliant with the DSS set up by the PCI. These regulations have been in place since 2005 and are there to help prevent fraud and identity theft.

The five credit card companies who make up the PCI Security Council are: American Express, Visa International, JCB International, and Discover Financial Services. Companies who take payments from customers via a third party such as PayPal may not have to become PCI compliant, since it is PayPal who process and utilise sensitive data such as credit card information.

All e-businesses who deal directly with the public however do need to know about and address PCI compliance.

There are twelve main areas which need to be addressed by e-businesses in order to become PCI compliant. These include making sure the website is protected by installing strong firewall packages and ensuring that the firewall installation is backed up by changing the default password supplied by the Firewall vendor; also choosing and regularly updating any anti-virus software. Another important area is that of encryption and safe storage of data held on a server.

E-commerce sites which have carried out all the protocols required by the Security Council will be considered PCI compliant. Compliance is assessed by Qualified Security Assessors.

Website owners will in the first instance require the services of Approved Scanning Vendors who have been approved by the Security Council in order to make an overview of the company's current level of compliance and help them improve procedures in order to be passed by the QSAs.