2 ms·
It's not so much law, as far as I'm aware, as the PCI/DSS requirements made by the credit card companies. Since they'll stop doing business with you if you don'
by red_admiral 3y ago
It's not so much law, as far as I'm aware, as the PCI/DSS requirements made by the credit card companies. Since they'll stop doing business with you if you don't follow their requirements, for all practical purposes, they have the force of law.
You could probably get sued for negligence if you process card details over an unencrypted connection, but that's nothing compared to the damage your business will take if the card companies decide that you're on the naughty list.
- account42 3y agoSure, since we do have TLS on the web card companies can require we use it. That doesn't mean that they would just disallow all online transactions if we did no have easy encryption available. Security is after all never the primary concern - if it was you would not interacting with other people and computers at all.