Search code examples
securitye-commercepaypalpci-dss

E-commerce compliance when card details are processed by a third party

What forms of e-commerce compliance such as PCI-DSS apply when the card details are processed by a third party such as Paypal?

Am building a bespoke shopping cart system that uses Paypal Express, so the card details never hit my server. I do however retain customer details so what compliance - both at a code and hardware level - must or should I be adhering to?

Solution

  • According to the PCI DSS, you only need to encrypt customer details if they are stored along with the PAN (aka credit card number). Since you aren't storing or transacting the PAN, there should be nothing extra you need to do.

    See page 5 on the PCI DSS:

    https://www.pcisecuritystandards.org/security_standards/pci_dss_download.html