E-commerce compliance when card details are processed by a third party

Question

What forms of e-commerce compliance such as PCI-DSS apply when the card details are processed by a third party such as Paypal?

Am building a bespoke shopping cart system that uses Paypal Express, so the card details never hit my server. I do however retain customer details so what compliance - both at a code and hardware level - must or should I be adhering to?

Answer 1

According to the PCI DSS, you only need to encrypt customer details if they are stored along with the PAN (aka credit card number). Since you aren't storing or transacting the PAN, there should be nothing extra you need to do.

See page 5 on the PCI DSS:

https://www.pcisecuritystandards.org/security%5Fstandards/pci%5Fdss%5Fdownload.html

Answer 2

If credit card data never physically hits your server (including RAM due to a form post) then PCI-DSS does not apply. Outsourcing your credit card handling to a compliant third party is by far the easiest way to be compliant yourself.