Home › Blog › Compliance training

PCI DSS Training: What Payment Card Compliance Requires From Staff, Role by Role

PCI DSS training is not optional for any business that takes card payments: the Payment Card Industry Data Security Standard requires a security awareness programme, training for every relevant person when they join and at least once every 12 months, and, since 31 March 2025, specific coverage of phishing and social engineering. Below is what version 4.0.1 of the standard actually asks for, which roles need extra training, and how a small or mid-sized UK business can meet it without buying more than it needs.

Why PCI DSS training matters

PCI DSS is the security standard set by the PCI Security Standards Council, the body founded by the major card brands. Any organisation that stores, processes or transmits cardholder data, or can affect its security, has to comply. In the UK it is not a statute: it is enforced through your merchant agreement with your acquirer or payment provider, which can charge non-compliance fees or, after a breach, pass on fines and the costs of investigation and card reissue. A breach that exposes personal data is also a matter for the ICO under UK GDPR, which is where the legal penalties sit.

Most card data breaches start with a person, not a server: an email that harvests a password, a caller pretending to be IT support, a tampered terminal no one noticed. That is why the standard puts training into its requirements rather than leaving it to good practice.

What PCI DSS v4.0.1 requires

Requirement 12.6 sets out the security awareness programme. In plain terms:

12.6.3.1 and 12.6.3.2 were new in version 4.0 and were "future-dated" best practice until 31 March 2025, when they became mandatory. An assessor will look for records showing each person was trained when they started and in the last 12 months, the materials used, and the signed or recorded policy acknowledgements.

Role-based training elsewhere in the standard

Requirement 12.6 applies to everyone. Other parts of PCI DSS add training for particular jobs:

• Staff who use card terminals. Requirement 9.5 covers point-of-interaction devices. Shop, hospitality and front-desk staff must be trained to spot tampering or a swapped terminal, to check the identity of anyone who claims to be a repair engineer before letting them touch a device, and to report anything suspicious.
• Software developers. People who work on bespoke or custom software in scope must be trained at least once every 12 months in secure coding relevant to their job and languages (Requirement 6.2.2).
• Incident responders. Requirement 12.10.4 asks for appropriate, periodic training for people responsible for responding to suspected and confirmed security incidents.

What a good course covers

The standard does not prescribe a course, a length or a format. A programme that meets it for a typical merchant usually includes:

1. What cardholder data is, where it lives in your business, and the rule never to write down or email full card numbers.
2. Phishing: how to recognise a malicious email, text or call, and how to report one quickly. Simulated phishing emails are a common way to test this.
3. Social engineering in person and by phone, including the fake engineer and the fake manager.
4. Passwords, multi-factor authentication, locking screens and not sharing log-ins.
5. Acceptable use: personal devices, USB sticks, cloud storage and what may be installed.
6. Terminal checks for anyone who handles a card reader.
7. How to report an incident, and who to tell.

"Multiple methods" means more than a single annual video. A short e-learning module, a phishing simulation, a poster by the till and a briefing at the start of a shift together satisfy it, and they work better too.

How to set it up in a small business

1. Find out what is in scope. If you use a hosted payment page or a standalone terminal, your scope is small; your Self-Assessment Questionnaire (SAQ) shows which requirements apply.
2. List who needs what. Everyone needs the awareness training; till and reception staff add terminal checks; developers add secure coding.
3. Write or update the policy they will acknowledge. Our guide to building a compliance programme covers policy structure.
4. Train on day one as part of induction, and book the refresher for the same month each year.
5. Keep records: names, dates, content, scores and acknowledgements. Without them, the training did not happen as far as an assessor is concerned.
6. Review once a year, adding whatever scam is doing the rounds.

Choosing a provider

Generic cyber awareness courses can meet 12.6.3 if they cover phishing, social engineering and acceptable use, and you add your own policy and terminal checks. Ask any provider for a mapping to the 12.6 sub-requirements, completion reports you can export for your assessor, and phishing simulations. The PCI Security Standards Council runs its own qualification courses, such as for internal security assessors, but those are professional training for compliance staff, not the all-staff awareness training the standard requires.

PCI training fits alongside your other mandatory courses; see our guides to corporate compliance and the government's Cyber Governance Code of Practice for the board-level side.

Sources: PCI Security Standards Council, PCI DSS v4.0.1 (June 2024), Requirements 6.2.2, 9.5, 12.6 and 12.10.4. Checked 11 November 2026.

More practical guides on the E-Business Ethics homepage.