It's been quite a while since I've been involved with PCI, but it was mostly a compliance system for dealing with fraud risk. I don't remember any legal aspects

It's been quite a while since I've been involved with PCI, but it was mostly a compliance system for dealing with fraud risk. I don't remember any legal aspects of it though. There are different levels of PCI, each with requirements for risk mitigation. Edit: Fixed an apostrophe.