PCI DSS is not a law, it’s a standard. But, it’s mandated by the contract that your company signs with the card companies as well as the banks that handle payment processing.