If your business handles credit card payments, you need to be concerned about the rules and regulations of safeguarding the sensitive cardholder data. I was reminded of this the other day when a charge for $9.95 showed up on my debit card from a website I've never visited. Any business that accepts credit card payment--this probably means you--is expected to follow the Payment Card Industry Data Security Standard (PCI DSS). The current version is PCI DSS v4.0.1. Big merchants may need an outside assessor. Most small businesses can do it themselves with a Self-Assessment Questionnaire, or SAQ. Check with your bank or payment processor about which applies to you. There are several SAQ types, depending upon...
...how you take credit card payments.
If your website sends people to a PCI-compliant payment provider like PayPal and you never handle card data yourself, you'll likely use the shortest version (SAQ A). If you accept card data on your own site, you'll likely need the longest version (SAQ D), which covers far more requirements. Why bother? Because your bank or processor can require it, and if card data is ever mishandled, being able to show you've done the work matters.
A little work now can head off a lot of grief in the future. The simplest way to stay safe is to never touch card numbers at all. Have your site hand customers off to a hosted payment page from a PCI-compliant provider (like PayPal, Stripe or Authorize.net), and many providers can make that page look close to your site. Skipping this stuff is risky: if card data is mishandled, your processor can fine you or even stop letting you take cards.
If you sell online and aren't sure where you stand, let's talk.