Complying with PCI DSS will hopefully reduce the risk of a security incident involving the loss of cardholder data, but if it does happen, you must report the compromise immediately to the relevant card brands. At this point, fines are normally levied against the merchant, and there may be a requirement to engage with a PCI Forensic Investigator to understand what happened, the scale of the compromise, and to remediate any immediate security holes. From there, your compliance may need to be verified by a QSA, in the form of a Report on Compliance (ROC).