New Zealand Government Web Standards

21.2 Compliance to PCI DSS for credit card details online

New standards released

The New Zealand Web Standards 2.0 were released in March 2009 and replace the previous version, the New Zealand Government Web Standards 1.0 (below).  See Meeting the standards for more information.

The Standard

21.2 Any capture of credit card details online must comply with the Payment Card Industry (PCI) Security Standards Council's Data Security Standards (DSS).

Guide to this Standard

Online payments in NZ are via credit card. As of Jan 2007, EFTPOS will also be available.

If your site is to take online payments, all pages relevant to the payments process must be secure, as defined in 21.1 - Security requirements for internet exchange of personal information.

You should contact the bank that your agency utilises for its general banking, for assistance regarding incorporation of online payments facilities in the agency's web site(s).

Full details of customer's credit cards should not be persisted. The agency needs to consider the risk (and the need) of doing so. Generally, the first 4 and last 4 digits of the credit card number are recorded, if there is need to record them at all, such as if there is any post-transaction customer dispute regarding billing.

Any persisting of payment card details should have the details made clear that this is taking place, what specifically is being persisted and why, in a web location pertinent to the payments process and/or in the disclaimer page.

Rationale of this Standard

This standard recognises the importance that government places upon the security of personal information. Agencies are required to comply with standards of non-government organisations when services of those organisations are utilised within NZ government agency web sites.