PCI compliance is not required by law. However, it is enforced through a contractual agreement between merchants, banks or card issues, and the payment processor.