PCI DSS (Payment Card Industry Data Security Standard)
PCI DSS is the global security standard that applies to any business that stores, processes or transmits payment card data. In hotel distribution it governs how card details travel between guests, booking engines, OTAs, channel managers, PMSs and payment providers.
The standard is maintained by the PCI Security Standards Council and sets requirements for network security, encryption, access control, monitoring and regular testing. Compliance is validated through a self-assessment questionnaire or an external audit, depending on transaction volume.
How it shows up in hotel distribution
- Direct bookings: the booking engine and payment page must be PCI compliant, which is why most hotels use a hosted or tokenized payment form rather than handling raw card numbers.
- OTA reservations: under the agency model, guest card details may be passed to the hotel; under the merchant model, the OTA collects payment and typically settles with the hotel by VCC.
- Connectivity: the channel manager and PMS must securely handle or tokenize card data passed in reservations.
Example
A hotel receives an agency-model reservation with the guest's full card number in the booking message. If that number is copied into email, a spreadsheet or an unsecured note field, the hotel is storing card data outside a compliant system, which is a PCI DSS breach even if no fraud occurs.
Why it matters
Non-compliance can lead to fines from card networks, higher processing fees, liability for fraud losses and reputational damage after a data breach. Tokenization, payment links and merchant of record setups reduce the amount of card data a hotel touches and therefore its compliance burden.
Related
- SCA (Strong Customer Authentication) — authentication rules for European card payments
- Chargeback — dispute process that often follows card fraud
- GDPR — the separate privacy regime covering guest personal data