Who handles your card data? New PCI guide on service providers

On 10 November 2026 the PCI Security Standards Council released "Understanding PCI DSS Service Providers", a guide on the outside companies behind your card payments, such as the payment gateway, web host or IT support firm. If you take cards online or in a shop, list these providers and get each one to confirm in writing what it covers.

What the new guide says

The council calls these outside companies third-party service providers, or TPSPs. Under PCI DSS Requirement 12.8, a business that uses them is expected to:

• keep a list of its TPSPs;
• have a written agreement with each one;
• check a provider before signing up with it;
• check each provider's PCI DSS status at least once every 12 months;
• record which requirements the provider looks after, which ones the business looks after itself, and which ones are shared.

Requirement 12.9 is the other side. The provider has to accept its responsibility to you in writing and answer your requests for information. A provider that handles part of PCI DSS for you, or whose service can affect your security, should give you evidence that it meets the requirements for that service. The council lists hosting, backup, remote administration and managed network services as examples of services that can affect security.

The guide also has a decision flow for working out whether a company counts as a TPSP, a seven step process for managing them, and FAQs. It does not change any PCI requirement.

What to do

1. Write down every company that touches your payments or the systems around them. For a typical Malaysian online shop that means the payment gateway, the web hosting company, the web developer or agency, and whoever looks after your plugins, backups or remote support.
2. For each one, ask a simple question: which PCI DSS items do you take care of, and which are left to us? Ask for the answer by email or in the contract, so you have it in writing.
3. Ask each provider for proof of its PCI DSS status. The council mentions the provider's Attestation of Compliance (AOC) as one form of this.
4. Keep a folder with the list, the agreements, the written answers and the proof, and set a reminder to ask again every year.
5. If a plugin or app on your shop sends card details anywhere, ask your developer which company receives them and add that company to the list.
6. Not sure what applies to your business? Check with your payment provider or bank. The council says the same: questions about your own obligations go to your acquirer or the organisation that runs your compliance programme.

Our earlier post on free PCI guides for small shops covers passwords, remote access and updates. If you are planning a new shop, our ecommerce web design team can tell you which parts of the checkout sit with the gateway and which sit with us.

Source and credit

We are sharing this news from the PCI Security Standards Council. This summary is written by Synctech in our own words.

• PCI SSC Publishes New Guidance on Understanding PCI DSS Third-Party Service Providers, PCI Perspectives blog, PCI Security Standards Council, 10 November 2026: https://blog.pcisecuritystandards.org/pci-ssc-publishes-new-guidance-on-understanding-pci-dss-third-party-service-providers

Retrieved 11 Nov 2026. PCI DSS is a trademark of its owner. Synctech is not connected with the PCI Security Standards Council. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.