PCI DSS for hotels: why compliance is harder than it looks

PCI DSS is not UK law, but it is contractually mandatory

The Payment Card Industry Data Security Standard is not enacted by Parliament and no UK regulator enforces it directly. It is a private contractual standard set by the major card networks (Visa, Mastercard, American Express, Discover, and JCB) and passed down to merchants through the agreement you sign with your acquiring bank or payment processor. That distinction matters less than hotel operators sometimes assume, because the enforcement mechanism is your ability to keep taking card payments at all.

Non-compliance fines are levied by the acquiring bank, typically ranging from £5,000 to £100,000 a month depending on merchant level and the severity of the gap, and they compound the longer the non-compliance continues. In the most serious cases, particularly following a confirmed card data breach, the acquirer can suspend or terminate your ability to process card payments altogether. For a hotel, losing card processing is closer to an existential threat than a fine.

The current version of the standard, PCI DSS v4.0, has been in effect since March 2024 and fully replaced the older v3.2.1. Acquirers and payment processors now assess hotels against v4.0 requirements, including a set of provisions that only became mandatory from March 2025.

Why scope is more complex in a hotel than a typical retailer

A high street shop usually has one till and one payment channel. A hotel has several, and each one is a separate point where cardholder data can be captured, stored, or transmitted:

• Booking engine. Your website or third-party booking platform captures card details at the point of reservation, often storing them for a guarantee against no-shows.
• Front desk and check-in. Card present transactions at check-in and check-out, plus manual card entry for phone or walk-in bookings.
• Restaurant, bar, and spa. Each outlet with its own till or card terminal is a separate cardholder data environment unless properly segmented.
• Telephone reservations. Staff taking card numbers over the phone and entering them manually into a booking system, one of the highest-risk channels because it often bypasses point-to-point encryption.
• Recurring charges and pre-authorisations. Holding card details on file for incidentals, damage deposits, or no-show charges extends the period cardholder data sits in your systems.

Merchant levels and which SAQ applies to your hotel

Your merchant level, set by your acquirer based on annual transaction volume, and how you take payments together determine which Self-Assessment Questionnaire (SAQ) you complete. Most hotels fall under Merchant Level 4, the lowest-volume tier, but the SAQ that applies still depends entirely on your payment architecture.

The 12 PCI DSS requirements applied to hotel operations

Regardless of which SAQ applies, the standard rests on 12 core requirement areas: install and maintain network security controls with firewalls segmenting payment systems from guest Wi-Fi and general hotel IT; never use vendor-supplied default passwords on point-of-sale terminals or back-office systems; never store the card verification code (CVV/CVV2) after authorisation, a common failure point when staff note it down for phone bookings; encrypt cardholder data in transit and at rest; keep systems patched against known vulnerabilities, particularly on property management and point-of-sale software that is often left on outdated versions; restrict access to cardholder data on a need-to-know basis by job role; assign a unique login to every staff member with system access rather than shared front desk credentials; restrict physical access to card readers, back-office servers, and any location where card data is processed; log and monitor all access to systems handling cardholder data; test security systems and processes regularly, including penetration testing appropriate to your SAQ level; and maintain a documented information security policy covering all staff, including seasonal and agency workers who are common in hospitality.

What changed in version 4.0

Version 4.0 made multi-factor authentication mandatory for all access into the cardholder data environment, not only for remote or administrative access as under the previous standard. It raised the minimum password length to 12 characters and introduced the option of targeted risk analysis, letting organisations justify specific control frequencies based on their own risk assessment rather than a single fixed timeframe for every merchant.

The most operationally significant change for hotels is requirements 6.4.3 and 11.6.1, which require an inventory of all scripts running on payment pages and monitoring for unauthorised changes to those scripts. This directly targets Magecart-style skimming attacks, where a compromised third-party script (a chat widget, an analytics tag, a booking engine plugin) silently captures card data as guests type it into your booking page. A hotel relying on a third-party booking platform needs to confirm that platform's own script inventory and change-monitoring controls, not just its own.

How to reduce your compliance scope

The single most effective compliance strategy for a hotel is reducing scope rather than fully securing a wide one. A hosted checkout page for online bookings, where the guest enters card details directly into your payment provider's page rather than your own, removes your systems from PCI DSS scope for that transaction entirely. Tokenisation, which replaces the actual card number in your systems with a non-sensitive token, achieves a similar effect for stored guarantee and pre-authorisation data.

Network segmentation, isolating point-of-sale and payment systems from guest Wi-Fi and general hotel IT on separate VLANs, is required to claim the reduced scope of SAQ B-IP or SAQ C rather than defaulting to SAQ D. For further detail on isolating guest-facing networks, see our guide to guest Wi-Fi network segmentation for hotels. At the front desk, using a certified external payment gateway rather than capturing and keying card numbers directly into the property management system removes another large chunk of scope. For a broader look at the sector's threat landscape, see our overview of cybersecurity risks in hospitality. Full technical detail on all current requirements is published by the PCI Security Standards Council.