I thought PCI compliance wasn't necessarily legally required, just that it was a contractual agreement between your company and the payment processor? Regardle

I thought PCI compliance wasn't necessarily legally required, just that it was a contractual agreement between your company and the payment processor? Regardless, I still feel reporting is the ethical thing to do.