Yes. Though not legally binding, PCI compliance is a mandatory step for any business in the UK that processes, stores, or transmits payment data in order to protect themselves and their customers from cybersecurity threats.