Any business that handles payment card data in any way, such as accepting payment cards, processing transactions, storing cardholder data, or transmitting cardholder data must comply with the PCI requirements.
Some businesses are required to undergo more rigorous assessments and provide more proof of compliance than others, depending on the company’s merchant level. The merchant level is determined by the payment card company (Visa, MasterCard, etc.) and is based on the number and type of payment card transactions the merchant processes each year.