PCI-DSS applies to which entities?

• A. Only banks.
• B. Any company or entity that handles credit card transactions.
• C. Only online retailers.
• D. Only credit card processors.

Answer: (B)

PCI-DSS protects cardholder data wherever it travels in the payment system, and it applies to any organization that accepts, processes, stores, or transmits credit card information. This means not just banks or online retailers, but any company or entity involved in handling card data, including merchants, processors, and service providers, regardless of size or channel. Therefore the best answer is that any company or entity that handles credit card transactions must comply with PCI-DSS. The other options are too narrow because banks, online retailers, or processors alone do not cover all participants who interact with card data. If you handle card data in any capacity, you’re in scope.