Retail businesses that accept card payments fall under PCI DSS, the Payment Card Industry Data Security Standard. As of PCI DSS 4.0.1, every requirement, including the additional controls that were previously optional, is mandatory for any business that stores, processes, or transmits cardholder data, whether that is a single boutique with a card reader or a multi-store chain running an integrated POS platform. California retailers also need to account for the California Consumer Privacy Act and its expansion under the California Privacy Rights Act, which give customers rights over the data your business collects, including purchase history and loyalty program information.
DCG does not provide legal compliance certification, and no managed IT provider should claim to guarantee compliance on your behalf. What DCG does provide is the technology foundation compliance depends on: network segmentation that reduces PCI DSS scope, access controls and audit logging, security monitoring, and documentation that supports your own compliance efforts when an assessor asks for evidence.