PCI DSS Fines

PCI DSS Fines & Penalties

PCI DSS non-compliance risks serious consequences for the organisation involved, so it’s important to ensure you’re following all regulations to avoid costly fines.

Who could receive PCI DSS fines?

It’s not just merchants and service providers that are liable to pay fines for PCI DSS non-compliance. Any organisation using a cardholder data environment (CDE) can receive a PCI DSS fine. This essentially means anyone accepting, storing, or transmitting credit card data – including schools, charities, and agencies.

What happens if my organisation has a data breach?

In the unfortunate occasion your company is found to have had a data breach, it’s important to take responsibility and attempt to minimise the damage as quickly as possible. It’s also a priority to ensure that you are working hard to protect the people whose data was compromised.

For organisations responsible for a breach, the first thing you will need to do is protect your systems. In the first 24 hours, you will need to notify your payment provider of the issue and then lock your security system.

Once this security system has been locked, you should then unplug your network cables while keeping your systems powered. You will then need to back up your systems, logging everything you do during the process. These logs will also need to be maintained.

Any other processes will also need to be stopped unless you have the approval of a qualified data security consultant. Finally, you will need to record a snapshot of your security system to be sent to forensic analysis.

You will need to remain in constant contact with your payment provider, keeping them aware of the infringement. You will need to perform an initial investigation of the issue which is submitted to the bank alongside any payment account data that has been disclosed.

Both the forensic and stand-alone investigations will need to be continuously managed, following all PCI DSS requirements for both suspected and confirmed issues brought up by the breach.

What are the consequences of PCI DSS non-compliance?

PCI DSS fines for non-compliance can cost organisations hundreds to thousands of pounds – if not even more in extreme cases. Businesses could also expect to see increasing credit card processing fees or even lose their right to an account. For the gravest violations, businesses could even receive criminal charges.

PCI DSS fines and penalties from banks and payment providers

According to the PCI Compliance Guide, organisations found guilty of PCI DSS non-compliance could receive fines costing anywhere between £4,000-£80,000.

There may also be other penalties, including increased transaction fees or even a termination of your contract – depending on the payment provider’s terms and conditions. Repeat violations will result in even higher PCI DSS fines or further legal action.

PCI DSS fines from government bodies

Organisations found guilty of PCI DSS non-compliance will need to consider whether any GPPR laws or regulations have been broken.

Due to strict GDPR standards when it comes to data violations, the consequences are much more extreme. PCI DSS fines in these circumstances can reach up to £17 million or 4% of the organisation’s worldwide revenue, depending on which is the greater sum.

Are there any other penalties for PCI DSS non-compliance?

PCI DSS fines are not the only consequences if an organisation is found to be non-compliant. Alternative penalties for being found in breach of regulations include your business’ right to accept credit cards suspended and credit card replacement costs. More severe breaches are subject to potential fraud charges and mandatory forensic examination.

These consequences for PCI DSS would make it extremely difficult for your business to run effectively. This could be disastrous for a small-to-medium business running without any backup savings.

Avoid PCI DSS Fines & Penalties with Hicomply

Ensuring your business is compliant with all the appropriate regulations is the best way to avoid expensive PCI DSS fines. However, this can be a long, drawn-out process for those who aren’t fully confident in security compliance.

Using the Hicomply platform can help your company remain compliant by keeping you completely in line with the regulations. Our ISMS solution keeps all your documentation in one place, making preparing for testing and auditing simpler than ever. Contact us today for more information.